From 7e1525711a21e9767ce5886f53fd20c95208150e Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Wed, 15 Jul 2026 14:23:47 -0700 Subject: [PATCH] wiki: compile cascades-tucson (full) --- wiki/clients/cascades-tucson.md | 751 +++++++++++++------------------- wiki/index.md | 2 +- 2 files changed, 300 insertions(+), 453 deletions(-) diff --git a/wiki/clients/cascades-tucson.md b/wiki/clients/cascades-tucson.md index a032b2ca..cbf78c82 100644 --- a/wiki/clients/cascades-tucson.md +++ b/wiki/clients/cascades-tucson.md @@ -2,8 +2,8 @@ type: client name: cascades-tucson display_name: Cascades of Tucson -last_compiled: 2026-07-10 -compiled_by: Howard-Home/claude-main +last_compiled: 2026-07-15 +compiled_by: HOWARD-HOME/claude-main sources: - session-logs/2026-03-24-session.md - session-logs/2026-03-31-session.md @@ -116,6 +116,11 @@ sources: - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md - .claude/memory/reference_rmm_map_network_drive.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md + - clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md + - clients/cascades-tucson/docs/cloud/m365.md + - session-logs/2026-07/2026-07-15-mike-taylen-uisp-cascades-techplan.md backlinks: - projects/gururmm - wiki/systems/uos-server @@ -123,7 +128,7 @@ backlinks: # Cascades of Tucson -Senior living / assisted living facility in Tucson, AZ. Single 6-floor building plus a MemCare (Memory Care) wing on floors 5-6. ACG took over from a previous MSP. Primary compliance driver is HIPAA. Active multi-phase migration project ongoing as of 2026-07-01 -- the network/VLAN 20 staff-machine move is largely complete (22 machines migrated, ~6 stragglers left), with printer re-IP/GPO work now the lagging piece. Also on 2026-07-01: the caregiver roster was reconciled against the client's updated list (8 offboarded, 4 hired, `SG-Caregivers` now 35) and the caregiver Conditional Access policies were cut over to an interim posture allowing phone + desktop sign-in (on-network only) -- see Entra Access Architecture and Conditional Access / Caregiver Policies. +Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710). Single 6-floor building plus a MemCare (Memory Care) wing on floors 5-6. ~236 rooms. ACG took over from a previous MSP. Primary compliance driver is HIPAA. Active multi-phase migration project: domain join / VLAN 20 staff-machine move largely complete (22 machines migrated, ~6 stragglers), printer re-IP/GPO work is the lagging piece. Caregiver phone SSO Entra/identity side complete as of 2026-07-01 (35-member roster, licensed, CA cutover live). CARF Technology and System Plan finalized and delivered 2026-07-15. --- @@ -135,127 +140,80 @@ GPS is billed via a counter tied to the number of Syncro assets (not a fixed dev ## Entra Access Architecture (canonical overview) -**In one line:** a HIPAA-driven, identity-based access-control system that splits staff into two security postures and enforces them with **Microsoft Entra Conditional Access** on top of **hybrid identity** (Entra Connect), with **ALIS (clinical EHR) wired for SSO**. Tickets: #109412123 (Entra setup), #110680053 (domain migration). +**In one line:** a HIPAA-driven, identity-based access-control system that splits staff into two security postures and enforces them with **Microsoft Entra Conditional Access** on top of **hybrid identity** (Entra Connect), with **ALIS (clinical EHR) wired for SSO**. ### Foundation -- hybrid identity - On-prem AD `cascades.local` synced to Entra/M365 via **Entra Connect** (PHS + Seamless SSO). UPN suffix `cascadestucson.com`, so a user's **Windows login = email = M365/ALIS identity** (one credential everywhere). ### Two user buckets (the core design) -1. **Restricted -- caregivers + medtechs** (group `SG-Caregivers`, `8b8d9222`): sign in **only on the Cascades network** and **only on approved devices** (shared Galaxy phones + a set of caregiver laptops/desktops). **No MFA** (no personal devices) -- protected by **location + device** controls + 8h sign-in frequency instead. Effect: caregiver credentials are **useless off-site or off an approved device** -- the anti-hacker / bad-employee-from-home control. +1. **Restricted -- caregivers + medtechs** (group `SG-Caregivers`, `8b8d9222`): sign in **only on the Cascades network** and **only on approved devices** (shared Galaxy phones + a set of caregiver laptops/desktops). **No MFA** (no personal devices) -- protected by **location + device** controls + 8h sign-in frequency instead. 2. **Privileged -- admins / directors / managers / nurses** (NOT in `SG-Caregivers`): email + ALIS **from anywhere**, **seamless onsite / 2FA offsite** (Authenticator/PIN). Untouched by the caregiver lockdown. ### Conditional Access enforcement (caregivers) - `CSC - Block caregivers off Cascades network` (`e35614e1`) -- `CSC - Block caregivers on non-compliant device` (`ede985e2`) -- being replaced by a **device allow-list** (`CSC - Caregivers: allow-listed devices only`, `1b7fd025`): phones (`displayName -startsWith "CSC-"`) + tagged caregiver machines (`extensionAttribute1 -eq "CSCCaregiverDevice"`, or explicit deviceId). Note: extensionAttribute changes lag >70 min into CA's filter cache -- **deviceId matching is the lag-free lever** for the small device set. +- `CSC - Block caregivers on non-compliant device` (`ede985e2`) -- **DISABLED 2026-07-01** (superseded by allow-list at final lockdown; do not re-enable) +- `CSC - Caregivers: allow-listed devices only` (`1b7fd025`): phones (`displayName -startsWith "CSC-"`) + tagged caregiver machines (`extensionAttribute1 -eq "CSCCaregiverDevice"`, or explicit deviceId). Still report-only / TEST-group scoped. - `CSC - Caregiver sign-in frequency 8h` (`7d491c7a`) -- Rollout is **per-user via group membership** (test group `SG-Caregivers-DeviceTest` `db5849ec` carries the full rule set for one-at-a-time validation; promote to `SG-Caregivers` + disable compliance-block when validated). +- **[FIXED 2026-07-01]** `Require MFA for all users` (`7e87a1c7`) now excludes BOTH `SG-Caregivers-Pilot` and live `SG-Caregivers` (`8b8d9222`); break-glass excludeUsers preserved. +- Rollout is **per-user via group membership** (test group `SG-Caregivers-DeviceTest` `db5849ec` for one-at-a-time validation). +- **Caregiver Named Location:** trusted IPs `72.211.21.217/32`, `184.191.143.62/32`; live since 2026-04-29. CA location ID `061c6b06-b980-40de-bff9-6a50a4071f6f`. ### Devices -- **Phones:** Samsung A15s in Intune **Shared Device Mode** (Android Enterprise, device-token enrolled) -- live. -- **Laptops/desktops:** caregiver shared machines (Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC) joined to Entra so CA recognizes them and they go on the allow-list (group `Cascades - Caregiver Devices` `02c6f698` for policy targeting). +- **Phones:** Samsung A15s in Intune **Shared Device Mode** (Android Enterprise, corporate-owned dedicated). Enrollment profile: `CSC - Android Shared Phones (Entra SDM)` (`9a0fcc6d`). Dynamic group: `Cascades - Shared Phones` (`ea96f4b7`), rule `(device.enrollmentProfileName -startsWith "CSC - Android Shared Phones")`. **NEVER create a new enrollment profile** -- a differently-named profile falls outside the group rule. Reuse the existing profile's QR. Android enrollment token: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml` (expiry ~2091; treat `tokenExpirationDateTime` as a claim, not a fact -- use **Replace**, not Revoke, when the token goes stale). +- **Laptops/desktops:** caregiver shared machines (Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC) joined to Entra via Hybrid Entra Join; CA allow-list targets group `Cascades - Caregiver Devices` (`02c6f698`). +- **Managed Google Play binding:** owned by `MDMS@cascadestucson.com` -- if this account is deleted/disabled/unlicensed, every Android phone loses management. Vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`. ### ALIS SSO -- Entra app registration -> OIDC SSO into ALIS; **tenant-wide admin consent granted** (2026-06-03). Per-user join key = **ALIS staff Email must equal the Entra UPN**. Caregivers SSO silently on phones (ALIS-native 2FA off); office users SSO with offsite MFA. +- Entra app registration -> OIDC SSO into ALIS; **tenant-wide admin consent granted** 2026-06-03 (`AllPrincipals` `User.Read` on SP `e1cae4ad`). Per-caregiver: ALIS staff `Email` must equal Entra UPN exactly. Caregivers SSO silently on phones (ALIS-native 2FA off); office users SSO with offsite MFA. ALIS application: `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, daily sign-ins verified 2026-07-15. +- **How to enable ALIS SSO for one user:** set **Email = exact Entra UPN** in ALIS admin -> Staff -> record; user signs in via "Sign in with Microsoft"; turn off ALIS-native 2FA (native 2FA conflicts and locked out Karen Rossini). No local ALIS password needed for SSO users. -### Caregiver phone SSO go-live (SUBSTANTIALLY DONE 2026-06-30, roster reconciled + CA cutover 2026-07-01) -The caregiver phone-SSO onboarding was executed 2026-06-30. To silently SSO into ALIS on a shared Samsung phone, each caregiver must be (1) in `SG-Caregivers` (bypasses the tenant-wide all-users-MFA CA policy, falls under the location+device posture), (2) M365-licensed (Business Premium, which also carries the Entra ID P1 the CA lockdown needs per-user), and (3) have ALIS staff `Email` = Entra UPN. **Live AD state:** `OU=Caregivers` holds 42 objects = 40 enabled real caregivers + `pilot.test` (test artifact) + `n.castro` (disabled). All 40 real caregivers had NEVER logged into the domain (bulk-created 2026-05-16/18) and were UNLICENSED before this session. -- **DONE (Entra/identity):** all 40 caregivers added to `SG-Caregivers` (was 38; added `c.lassey` + `p.sandoval-beck`), assigned **Microsoft 365 Business Premium** (`usageLocation=US` first, then `assignLicense`), and given unique phone-typeable AD temp passwords with **forced change at next logon** (hybrid PHS -> the AD password is also the M365/phone sign-in). Temp passwords vaulted at `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` (40 entries; retrieve with `vault get`, NOT get-field -- keys contain dots; delivered to Howard via Discord DM). **`SG-Caregivers` is frontline caregivers ONLY** -- Veronica Feller + Christine Nyanzunda (admin-adjacent) and `pilot.test`/`n.castro` are intentionally excluded (reverses the earlier 6/4 plan to add Feller/Nyanzunda). -- **REMAINING gate (Howard handling -- ALIS side):** set each caregiver's ALIS staff `Email` = Entra UPN so "Sign in with Microsoft" resolves. Of the 40 AD caregivers: 23 confirmed ALIS caregivers (just need Email=UPN), 5 in ALIS with blank job role (confirm caregiver + Email=UPN), 5 Med Techs (Email=UPN; Howard earlier said "ignore for the moment" -- revisit), **7 have NO ALIS staff record (must be created before SSO can work)**, and **3 ALIS caregivers have no AD account** (Judith Palmer, Joey Ty, Alejandra Vallejo -- create AD accounts if they need phones). Also blanket-disable ALIS-native 2FA for the caregiver bucket as records are matched. NOTE: Zeke Huerta stays `e.huerta@cascadestucson.com` (do NOT "correct" to z.huerta) -- his ALIS Email must be `e.huerta@`. Build path: `alis` skill `build-import` -> upload .xls in ALIS UI (no staff-write API). -- **Prior crosscheck (2026-06-29):** phone-only caregivers = NONE (all caregiver rows are `D+P`; only the 3 Transportation drivers are phone-only and do not need ALIS). 7 caregiver-list people are present in ALIS only as **Discharged** records (Niel Castro, Kasey Flores, Bella Mendoza, Corey Tate, Gloria Williford, Mary Kariuki [DUP records 429856/429858], Maia Baker) -- decide reactivate-vs-recreate. **[RESOLVED 2026-07-09] Charity Sika (CSV) == Bariffa Sika (ALIS 309045)** -- same person; she has since legally changed her name to **Charity Menle** and the AD/Entra account was renamed to match (see Name changes below). -- **[UPDATE 2026-07-01] Roster reconciled against the client's updated caretaker list + CA phone-login cutover.** The client's list was checked 1:1 against live AD (`OU=Caregivers`, 42 objects) via GuruRMM. Executed on CS-SERVER: **8 accounts disabled + removed from `SG-Caregivers` + Business Premium reclaimed** -- the 7 already-flagged leavers (b.mendoza, c.tate, d.fierros, g.williford, k.flores, m.baker, m.kariuki, all previously ALIS-Discharged/no-record and never logged in) plus `t.lassey-assiakoley` (client confirmed Tele Sepopo Lassey Assiakoley = Celia Lassey -- a duplicate of `c.lassey`, which was kept). **4 new caretakers created** (OU=Caregivers + `SG-Caregivers` + Business Premium + forced-change temp passwords): a.vallejo (Alejandra Vallejo, already an ALIS caregiver with no prior AD account), j.munezero (Jeanpabtiste Munezero), n.cota (Nicole Cota), k.robinson (Katlyn Robinson). Temp passwords vaulted at `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml` (retrieve with `vault get`, not `get-field` -- dotted keys). **`SG-Caregivers` is now 35 members** (down from 40; cloud group `8b8d9222` verified synced with all 4 new hires present). SPB pool: 45 enabled / 41 consumed (4 free). - - **Zeke Huerta (e.huerta) moved to front desk** -- removed from `SG-Caregivers` only; his AD account stays in `OU=Caregivers` because Entra Connect's sync scope covers ONLY `OU=Caregivers` / `OU=Groups` / `OU=Caregiver Devices` -- an OU move would delete his cloud object. OU move deferred until `OU=Administrative` enters sync scope. He now falls under the tenant-wide `Require MFA for all users` policy with **no registered MFA method -- Authenticator registration is pending.** - - **Christine Nyanzunda reaffirmed OUT of `SG-Caregivers`** despite the client's list naming her as a caretaker -- Howard held the frontline-only rule (established 2026-06-30). She keeps her existing `christine.nyanzunda` account with its broader (admin-adjacent) access. - - **Caregiver phone/desktop login verified end-to-end and two CA blockers fixed** (Howard's go). Root cause: `pilot.test` had only ever worked because it sits in `SG-Caregivers-DeviceTest`/`-Test`, which are excluded from the compliance-block and targeted by the allow-list -- live caretakers hit both problems at once. **Fix 1:** `Require MFA for all users` (`7e87a1c7`) excluded only the stale `SG-Caregivers-Pilot` group -- added the live `SG-Caregivers` (`8b8d9222`) to `excludeGroups` (break-glass `excludeUsers` preserved). **Fix 2:** `CSC - Block caregivers on non-compliant device` (`ede985e2`) was blocking every caretaker device because the CSC-* phones report Intune-noncompliant (no Windows device is Intune-managed either) -- **disabled 2026-07-01, do not re-enable, superseded by the allow-list at final lockdown.** **Interim posture:** all caretakers may sign in on desktops AND phones, on-network only (`e35614e1` off-network block + `7d491c7a` 8h sign-in frequency remain enforced); the device allow-list (`1b7fd025`) stays scoped to the TEST group. This supersedes the 2026-06-24 "stay TEST-scoped, do not flip lockdown until all devices are domain-ready" decision. Phones-only lockdown is deferred to the end of the rollout -- tracking list `docs/cloud/caretaker-phones-only-list.md` (per the 4/22 staff CSV every caretaker is currently `D+P`; the phones-only cohort is TBD with the client). +### Caregiver phone SSO -- current state (as of 2026-07-15) +- **Entra/identity side COMPLETE** for the current 35-member `SG-Caregivers` roster. All 35 licensed Business Premium; forced-change flag cleared fleet-wide 2026-07-02 (temp passwords now valid for phone sign-in). Temp passwords vaulted: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` (40 initial) + `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml` (4 new hires). Retrieve with `vault get` (NOT `get-field` -- dotted keys). Do NOT inline values. +- **Remaining gate (ALIS side, Howard handling):** set each caregiver's ALIS staff `Email` = Entra UPN. Outstanding: 7 no-ALIS-record caregivers (need ALIS records built via `alis` skill `build-import` -> upload .xls in ALIS UI); Munezero/Cota/Robinson ALIS records needed; Vallejo Email=UPN; 5 Med Techs revisit; 7 discharged-record reactivate-vs-recreate decisions. +- **Interim CA posture (2026-07-01, Howard):** caretakers sign in on desktops AND phones, on-network only. Phones-only lockdown deferred to end of rollout; tracking list `docs/cloud/caretaker-phones-only-list.md`. +- **[RULE] Caregiver phone onboarding:** never set `ChangePasswordAtLogon $true` for a caregiver who will sign in on a shared phone -- it always fails as Entra `err=50126` (`Microsoft Authentication Broker` cannot render the forced-change screen). Diagnose: pull sign-in logs (unfiltered `?$top=50`, grep client-side) + check `pwdLastSet`/`PasswordExpired` on CS-SERVER. +- **`SG-Caregivers` is frontline caregivers ONLY.** Admin-adjacent staff (Feller, Nyanzunda), `pilot.test`, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400) -- all membership writes on CS-SERVER via RMM. +- **`PSO-Caregivers` (Fine-Grained Password Policy, created 2026-07-02):** Precedence 10, `MaxPasswordAge=00:00:00` (never expires). `AppliesTo = SG-Caregivers` -- auto-covers future hires; removal reverts cohort to 42-day domain default. Undo: `Remove-ADFineGrainedPasswordPolicy PSO-Caregivers`. -### Caregiver phone login -- forced-change-at-next-logon gotcha (RESOLVED 2026-07-02) -**Symptom:** a caregiver cannot sign in on the shared Samsung phone; Entra sign-in log shows `Microsoft Authentication Broker` failing with **`err=50126` ("invalid username or password")** -- but the account is enabled, SPB-licensed, in `SG-Caregivers`, and on-network. **Root cause:** the 6/30 (+7/1) bulk onboarding created every caregiver temp password with **"User must change password at next logon"** (`pwdLastSet=0`, `PasswordExpired=True`). A shared Android phone signs in through the Auth Broker, which **cannot render the forced "set a new password" screen**, so the sign-in dies and surfaces as `50126` even when the correct temp password is typed. This is NOT a CA/MFA/license/location problem. -- **Fix applied 2026-07-02 (Howard):** swept **all 35 `SG-Caregivers`** on CS-SERVER with `Set-ADUser -ChangePasswordAtLogon $false` (RMM cmd `45660cd8`). Every one was stuck (`cleared=35 already_ok=0`). This clears the must-change flag and un-expires the password **without changing it** -- the vaulted temp passwords (`clients/cascades-tucson/caregiver-temp-passwords-2026-06-30` + `-2026-07-01`) are now valid for phone sign-in; PHS syncs the state to Entra in ~2 min. Diagnosis first surfaced on Agnes McFerren (`a.mcferren`, temp `Meadow8541@`). -- **RULE for future caregiver onboarding:** phone-only/shared-device caregivers must be created with **`-ChangePasswordAtLogon $false`** (accept the risk of a static temp password, or have them complete the one-time change on a domain desktop **before** touching the phone). Never leave forced-change set on a caregiver who will sign in on a shared phone -- it always fails as `50126`. Diagnose via the `remediation-tool` sign-in logs (`$filter` on the signIns endpoint hangs on this tenant -- pull a small unfiltered page `?$top=50` and grep client-side) + `pwdLastSet`/`PasswordExpired` on CS-SERVER. +### Caregiver name changes -- rename, never re-create +**Case:** `b.sika` (Bariffa Sika) -> `c.menle` (Charity Menle, legal name change, 2026-07-09). Procedure: `Set-ADUser` (Surname/DisplayName/UPN/EmailAddress) -> `Rename-ADObject` (CN) -> `Set-ADUser -SamAccountName` -> `Start-ADSyncSyncCycle -PolicyType Delta`. Set `proxyAddresses` explicitly (primary SMTP new + alias old). Password and group membership do NOT change. Vault gotcha: Charity Menle's temp password is still filed under key `b.sika` in the 6/30 vault. -### Caregiver shared phones -- Intune enrollment + Managed Home Screen (verified 2026-07-09) -The 25 Samsung shared caregiver phones (`SM-A146U` x16, `SM-S146VL` x9, `SM-A146U1` x1) are Android Enterprise **corporate-owned dedicated devices** (`googleCloudDevicePolicyController`), enrolled by QR against ONE profile and configured entirely through group-targeted policy. +### Caregiver shared phones -- Intune (verified 2026-07-09) +- 25 Samsung shared caregiver phones (`SM-A146U` x16, `SM-S146VL` x9, `SM-A146U1` x1). 14 powered off as of 2026-07-09 (noncompliant status is not a fault). Two duplicate Intune objects (`CSC-R92W60LRA8Z`, `CSC-R9TW20DGYKF`) from re-enrollment. +- **Graph storage fields (`freeStorageSpaceInBytes`, `totalStorageSpaceInBytes`) are NOT collected** for Android Enterprise dedicated devices -- all 26 phones report `free=0`, which means "not reported," not "out of space." **`detectedApps` is empty on every phone** -- not an app-inventory source here. +- `samsungSM-F731U` (John Trozzi's Galaxy Z Flip 5, `trustType: Workplace`) is BYOD -- NOT a shared phone, correctly outside the profile/group. +- **Unresolved:** `CSC-R9TX70L693H` enrolled 2026-07-09, cycled MHS install/uninstall 6 times, stopped checking in. Root cause not established; handset swapped as bad. Stale Intune/Entra records should be deleted. Also stale: `com.microsoft.launcher` (consumer launcher) sits unassigned in the tenant app list -- harmless unless assigned. +- **Caregiver desktop/laptop management:** Hybrid Entra Join + on-prem GPO (Intune Windows MDM `INTUNE_A=PendingInput` -- MS case open, does NOT block caregiver access). `CSC - Caregiver Workstation` GPO (`{3B5CD9A6-A278-4676-A9FD-9396D21A8261}`) built + validated on NURSESTATION pilot.test. `CSC - Caregiver Device Lockdown` GPO (`{E6174988-2721-4D96-ADF5-F5BB44E92769}`) deployed to `OU=Caregiver Devices` 2026-06-05. NURSESTATION still needs reboot to activate lockdown GPO. -- **Enrollment profile:** `CSC - Android Shared Phones (Entra SDM)` = `9a0fcc6d-0a88-466e-aa53-44401bb74fca`, `corporateOwnedDedicatedDevice`. It **replaced** an older default-token profile named `CSC - Android Shared Phones`. -- **Settings ride the profile NAME, not the token.** Dynamic group `Cascades - Shared Phones` (`ea96f4b7-3000-45da-ab1f-ddb28f509526`) has rule `(device.enrollmentProfileName -startsWith "CSC - Android Shared Phones")`, so both names match. **NEVER create a new enrollment profile** to add phones -- a differently-named profile falls outside the rule and new phones enroll into a policy vacuum, looking fine while inheriting nothing. Reuse the existing profile's QR. -- **Policy targeting that group:** device configs `CSC - Android Shared Phones Restrictions` (`070a76c2` -- holds `kioskModeWallpaperUrl` + the 9 `kioskModeApps` incl. the Alis/HelpAny/LinkRx web apps, `kioskModeUseManagedHomeScreenApp: multiAppMode`) and `CSC - CSCNet Wi-Fi` (`b572ba54`, no proxy); app configs `CSC - MHS layout` (`27683709`), `... Shared Device Mode (Teams)`, `... (Authenticator)`. Ten apps assigned `required`; none `uninstall`. -- **Wallpaper + links render only once Managed Home Screen (`com.microsoft.launcher.enterprise`) installs** from Managed Google Play and takes over as launcher. Until then a new phone shows the stock Samsung home screen. The wallpaper is fetched by the phone from the public `https://cascadestucson.com/...` URL -- if links appear but the background does not, check that egress, not the profile. -- **Brightness/volume are NOT caregiver-adjustable today.** MHS schema keys `show_brightness_slider`, `show_adaptive_brightness_toggle`, `show_volume_setting` all default **False**; `show_managed_setting` defaults True, so the Managed Settings icon is present but empty. To enable, add the keys to `payloadJson` on app config `27683709` (keep `screen_orientation` / `set_grid_size` / `lock_home_screen`). **Intune has no per-device app config** -- it targets the group, so this is necessarily fleet-wide; a second app config for the same app on one device is a conflict, not a scoping trick. -- **Managed Google Play binding is owned by `MDMS@cascadestucson.com`** (`boundAndValidated`). That account -- not the token -- is the single point of failure for ALL Android management: if it is deleted/disabled/unlicensed, every phone loses management. Vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`. -- **Stale-device cleanup is OFF** (`deviceInactivityBeforeRetirementInDays: null`), so a phone that stops checking in is never auto-retired. Enrolled phones do not "fall off" on their own, and an enrollment token is a one-time entry ticket -- revoking or replacing it **never** affects already-enrolled devices and never requires a reset. - -#### Enrollment token -- Replace, don't Revoke (incident 2026-07-09) -The token vaulted in `mdm-service-account.sops.yaml` (`android_enrollment.token`) went **stale**, and its successor was then **rejected by Google at redemption** ("checking code" -> error, contact your IT admin) *despite Graph reporting a 2027 expiry* and a healthy Play binding. `tokenExpirationDateTime` reflects what Intune requested, not what Google still honors -- **treat it as a claim, not a fact.** Fix: Intune portal -> the existing profile -> Token -> **Replace token** (Revoke alone leaves the profile with NO usable token). The replacement issued a **2091** expiry (~65 years, effectively never) and enrolled a phone immediately -- so a long validity is NOT what caused the rejection, and an effectively-never-expiring token IS available. Current token, profile id, and the exact re-pull command: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml`. -Re-pulling the QR needs the **`tenant-admin`** remediation-tool tier (`DeviceManagementConfiguration.Read.All`); `investigator` 403s: -`GET /beta/deviceManagement/androidDeviceOwnerEnrollmentProfiles/?$select=qrCodeImage` -> base64 PNG (256x256; upscale nearest-neighbour if it will not scan). `qrCodeContent` is base64-wrapped JSON, not raw JSON. - -#### Graph fields that are NOT evidence on these devices (cost real time 2026-07-09) -- **`freeStorageSpaceInBytes` / `totalStorageSpaceInBytes` are not collected** for Android Enterprise dedicated devices. ALL 26 phones report `free = 0` and an implausible total (4.54 / 5.38 GB). A `0` here means "not reported", NOT "out of space". Reading it as a measurement produced a confidently wrong "the phone is full and it's the wrong model" diagnosis -- the handset actually had ~15 GB used of 64 GB, and `SM-S146VL` is 9 of the fleet's own phones, including ones that work. -- **`detectedApps` is empty on every one of these phones**, including phones that sync daily. It is not an app-inventory source here; never conclude an app did or did not install from it. -- The only trustworthy device-side signals are **`lastSyncDateTime`** and **`deviceConfigurationStates`**. -- **Compliance tracks check-in, not health**: a phone that has not synced evaluates `noncompliant`. As of 2026-07-09, **14 phones are simply powered off** (Howard confirmed) -- their `noncompliant` status is not a fault. Two records (`CSC-R92W60LRA8Z`, `CSC-R9TW20DGYKF`) are duplicate objects from re-enrollment; 22 unique physical phones. `samsungSM-F731U` in the Android list is **John Trozzi's personal Galaxy Z Flip 5** (`trustType: Workplace`, BYOD) -- correctly outside the profile/group, not a shared phone. - -#### Unresolved -`CSC-R9TX70L693H` (enrolled 2026-07-09 18:33Z) enrolled cleanly -- single device object, both profiles applied, joined the group -- but cycled install/uninstall of Managed Home Screen + Alis 6+ times and stopped checking in at 18:51Z. Every Intune-side control was verified correct (assignments/intents, no duplicate packages, `playStoreMode: notConfigured`, no Wi-Fi proxy, stable group membership) and 11 identical phones run the same config. **Handset swapped out as bad (known prior issues).** Root cause never established; Graph exposes no app-install state for COSU devices, so the failure reason is visible only in the work Play Store on the device itself. Its stale Intune/Entra records should be deleted. Also stray: **`Microsoft Launcher`** (`com.microsoft.launcher`, the consumer launcher) sits unassigned in the tenant app list -- harmless now, but it would fight Managed Home Screen if ever assigned. - -### Caregiver name changes -- rename, never re-create (Charity Menle, 2026-07-09) -A caregiver who legally changes her name gets the **existing AD object renamed**, not a new account. Creating a second account duplicates the identity, burns a second Business Premium seat, and leaves two AD objects competing for one ALIS staff record (the failure mode behind the `t.lassey-assiakoley` duplicate on 7/1). -- **Case:** `b.sika` (Charity Sika, legal first name Bariffa -- the `b.` initial) -> **`c.menle` / `Charity Menle`**. Howard updated ALIS staffId 309045 first (`Email = c.menle@cascadestucson.com`); AD was then renamed to match, because ALIS SSO joins on **ALIS `Email` == Entra UPN**. -- **Procedure (CS-SERVER, verified 2026-07-09):** `Set-ADUser` sets `Surname`/`DisplayName`/`UserPrincipalName`/`EmailAddress`, then `Rename-ADObject` for the CN, then `Set-ADUser -SamAccountName`. Follow with `Start-ADSyncSyncCycle -PolicyType Delta` (the ADSync module lives on CS-SERVER). Entra export is async -- the cloud object still shows the old UPN for up to a minute; poll before concluding the sync failed. -- **Always set `proxyAddresses` explicitly** -- `SMTP:@` (primary) + `smtp:@` (alias). These caregiver objects have an EMPTY `proxyAddresses`, so Exchange Online derived primary SMTP from the UPN at provisioning; renaming the UPN alone is not a reliable way to move the primary SMTP, and without the old address as an alias, inbound mail to it bounces. Entra Connect preserves the tenant `*.onmicrosoft.com` routing alias on its own. -- **The password does NOT change** and no group/license action is needed (`SG-Caregivers` membership, Business Premium, and `PSO-Caregivers` all ride the unchanged object). **Vault gotcha:** her temp password stays filed under the OLD key -- Charity Menle's is `b.sika` in `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. She now signs in as `c.menle` with that same password. - -### Caregiver password expiry -- `PSO-Caregivers` (never-expire, created 2026-07-02) -**Why it exists:** caregiver temp passwords are used on shared phones that cannot run the "must change password" flow, so ANY password expiry re-breaks phone login (see the forced-change gotcha above). To stop the 42-day domain `MaxPasswordAge` from re-expiring the whole cohort (~2026-08-13), a **Fine-Grained Password Policy `PSO-Caregivers`** was created on CS-SERVER. -- **Config:** Precedence 10, **`MaxPasswordAge=00:00:00` (never expires)**; every other setting mirrors the Default Domain Policy (Complexity on, MinLength 7, History 24, Lockout 5 / 30 min). `AppliesTo = SG-Caregivers` -- rides the group, so it **auto-covers future hires** and a user removed from the group reverts to the 42-day domain default. **Verified:** `Get-ADUserResultantPasswordPolicy` returns `PSO-Caregivers` (`MaxPasswordAge=00:00:00`) for the cohort. Creating it did NOT change any current password. -- **Rotation model:** on-EVENT only (offboarding, role change, suspected compromise -- e.g. the 7/1 reconcile), NOT on a schedule -- aligns with NIST 800-63B, and schedule rotation is impossible on shared phones anyway. Compensating controls: onsite-only CA (`e35614e1`), device allow-list (`1b7fd025`, pending SG-Caregivers), 8h reauth (`7d491c7a`), no MFA/personal device, auto-logoff GPO. -- **Undo:** `Remove-ADFineGrainedPasswordPolicy PSO-Caregivers` -> caregivers revert to domain default (42-day expiry). It is `ProtectedFromAccidentalDeletion`. - -### Caregiver desktop/laptop management -- Hybrid Entra Join + GPO (the chosen path) -Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingInput`; no Windows device ever Intune-enrolled -- MS case open), Windows caregiver devices are managed via **Hybrid Entra Join + on-prem Group Policy** instead. This needs no Intune. The CA access model is unchanged (hybrid join just gives the device an Entra object so the allow-list/deviceId still applies). -- **Hybrid join proven on NURSESTATION-PC** (2026-06-05): SCP written (`ConfigureSCP.ps1`), `OU=Caregiver Devices,OU=Staff PCs,OU=Workstations` added to Entra Connect sync scope -> device synced to Entra as `trustType: ServerAd`, `dsregcmd` shows AzureAdJoined+DomainJoined YES, pilot.test gets `AzureAdPrt: YES`. On hybrid-joined machines `Ngc PreReqResult: WillNotProvision` (PolicyEnabled NO) -> **Windows Hello does not auto-provision** (no Hello popup) -- exactly what shared caregiver devices need, so no separate Hello-disable step. -- **Device control is one-at-a-time:** caregiver machine computer objects are moved into `OU=Caregiver Devices` (only that OU is in sync scope) and into a location group `SG-PC-MainTower` or `SG-PC-MemoryCare`. Add a device = move it into the OU + correct location group. -- **App + printer delivery GPO `CSC - Caregiver Workstation`** (`{3B5CD9A6-A278-4676-A9FD-9396D21A8261}`, User-config GPP) -- **BUILT + VALIDATED on NURSESTATION as pilot.test (2026-06-05).** Linked at `OU=Caregivers,OU=Departments`; security filter = `SG-Caregivers-Test` (Apply, pilot.test only) + Authenticated Users (Read, for MS16-072). Go-live = swap filter to `SG-Caregivers`. Contents: 3 desktop shortcuts -- ALIS, LinkRx, **Helpany** (`https://app.safe-living.com/login` -- named "Helpany," the brand caregivers know) -- + 6 `\\CS-SERVER` shared printers (NursesPrinter, HealthServices, MCMedTech, MCReception, MCDirector, CopyRoom) with **default printer by device location** (Nurses for `SG-PC-MainTower`, MC MedTech for `SG-PC-MemoryCare`, computer-context ILT) + HKCU `LegacyDefaultPrinterMode=1` so the default sticks. Build scripts: `clients/cascades-tucson/scripts/build-caregiver-gpo.ps1` + `link-caregiver-gpo.ps1`. NOTE: the domain-wide `CSC - Printer Deployment` GPO is intentionally disabled (empty CSE / version 0) and is **not** to be used -- reference only. -- **Device lockdown GPO `CSC - Caregiver Device Lockdown`** (`{E6174988-2721-4D96-ADF5-F5BB44E92769}`, computer-only, linked to `OU=Caregiver Devices`) -- **DEPLOYED 2026-06-05.** Auto-logoff is a HIPAA requirement (SS164.312(a)(2)(iii)) for shared PHI devices. Settings: screen **lock at 3 min**, **auto sign-out at 15 min** total idle, **90-second warning** before sign-out, **never sleep** (display off 10 min). Delivered via a computer **startup script** (`caregiver-lockdown.ps1`, in SYSVOL) that sets `InactivityTimeoutSecs=180`, powercfg, and registers a logon-triggered scheduled task running an idle monitor in each caregiver's session. Deploy script: `deploy-device-lockdown-gpo.ps1`. **Startup scripts run at boot -- NURSESTATION must reboot** to activate (not yet verified). **Companion:** ALIS app session timeout 20->15 min (Howard, ALIS admin) **PENDING.** Lock/logoff are **device-level** (affect any user on the device in `OU=Caregiver Devices`). - -### Status (as of 2026-07-02) -- **[ROSTER 2026-07-02] 7 already-disabled leavers HARD-DELETED from AD** (client roster update): `b.mendoza`, `c.tate`, `g.williford`, `k.flores`, `d.fierros`, `m.baker`, `m.kariuki` -- all disabled/never-logged-in since the 7/1 reconcile; now removed (cloud objects soft-delete on next Entra Connect sync, 30-day recycle bin). **`SG-Caregivers` stays 35** (they were already out of the group; deleting disabled non-members doesn't change the count). Live-verified gone (RMM cmd `a5f337fd`). -- **[ROSTER 2026-07-13] Juan Andrade (`j.andrade`) -- offboard date moved to 2026-07-16 AFTERNOON** (was 07-11; per Howard 2026-07-13). Still active and in `SG-Caregivers`, deliberately **HELD** (do NOT disable while he's working). On 7/16 PM: disable + remove from `SG-Caregivers` + reclaim Business Premium. Tracked in `docs/cloud/caretaker-phones-only-list.md` + coord todo `80716a98` (created 2026-07-13 -- no todo existed before that despite the earlier note). -- **Caregiver phone SSO -- Entra/identity side COMPLETE for the current 35-member roster** (group + Business Premium license + AD temp passwords, **must-change flag cleared fleet-wide 2026-07-02** -- see the forced-change gotcha above; temp passwords now valid for phone sign-in). Remaining gate is the ALIS Email=UPN match (Howard) + creating ALIS records for the 3 brand-new hires (Munezero, Cota, Robinson) + setting Vallejo's ALIS Email=UPN + the outstanding items from 6/30 (7 discharged-record decisions, Kariuki ALIS dup 429856/429858 dedupe if she returns). -- **Caregiver CA lockdown is LIVE (interim posture, 2026-07-01):** caretakers sign in on desktops and phones, on-network only -- see the 7/1 update above and Conditional Access / Caregiver Policies. Phones-only lockdown deferred to end of rollout. -- **Proven working end-to-end on a hybrid-joined desktop (NURSESTATION + pilot.test):** caregiver lockdown (CA off-network block + device allow-list) **and** silent ALIS SSO. The allow-list policy `1b7fd025` carries NURSESTATION's current deviceId `d3bf931f-f128-4261-8398-b46c34a4b342` and the device is tagged `extensionAttribute1=CSCCaregiverDevice`. -- **GPOs DEPLOYED:** `CSC - Caregiver Workstation` built and validated on pilot.test. `CSC - Caregiver Device Lockdown` deployed to `OU=Caregiver Devices` 2026-06-05. **Go-live (still gated on all devices domain-ready):** swap GPO filter `SG-Caregivers-Test` -> `SG-Caregivers`; CA allow-list test group -> `SG-Caregivers`; move real caregiver machines into `OU=Caregiver Devices` + correct `SG-PC-*` location group one at a time. **Still pending:** lower ALIS app timeout 20->15 min; reboot NURSESTATION to verify lockdown. -- **Independent open item:** Microsoft case for `INTUNE_A PendingInput` -- does NOT block caregiver access (hybrid+GPO path replaces the Intune dependency). +### Status (as of 2026-07-15) +- **[ROSTER 2026-07-02]** 7 already-disabled leavers hard-deleted from AD (b.mendoza, c.tate, g.williford, k.flores, d.fierros, m.baker, m.kariuki). `SG-Caregivers` stays 35. +- **[PENDING] Juan Andrade (`j.andrade`) offboard 2026-07-16 afternoon** -- still active and in `SG-Caregivers`. On 7/16 PM: disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`. +- **[PENDING]** Zeke Huerta (moved to front desk 2026-07-01, removed from `SG-Caregivers`): no registered MFA method -- Authenticator registration pending. OU move to `OU=Administrative` deferred until that OU enters Entra Connect sync scope. +- **[PENDING] Pilot cleanup:** delete `pilot.test@cascadestucson.com`, clean up `howard.enos@cascadestucson.com`, remove `SG-Caregivers-Pilot` from CA policy targets + delete the group. --- ## Profile - **Contract type:** Prepaid hour block -- **Key contacts:** - - Meredith Kuhn -- Assistant Manager (ASSISTMAN-PC); internal billing contact. **NEVER set her as ticket contact in Syncro** -- she is the wrong default that keeps being selected. - - John Trozzi -- Maintenance staff, Mac at 201cascades@gmail.com (shared facility account) - - Lauren Hasselman -- Accounting - - Zachary Nelson -- Accounting Assistant - - Lois Lane -- CareTakers department head (DESKTOP-KQSL232); resistant to domain migration; John Trozzi is liaison - - Crystal Rodriguez -- staff - - Sharon Edwards -- Life Enrichment Assistant (DESKTOP-DLTAGOI) - - Ashley Jensen -- Accountant (DESKTOP-U2DHAP0) - - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC, Win Home / not domain-joined). Domain account `CASCADES\Shelby.Trozzi` (`OU=Care-Memorycare`, not Entra-synced); first password set 2026-07-02, vaulted. Has `\\CS-SERVER\Company Web Docs` (Change) mapped as `W:`, plus FullAccess+AutoMap on Alma Montt's converted shared mailbox. - - Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren). **Accounting mailbox access 2026-07-09:** granted FullAccess (auto-mapping) + SendAs on `accounting@cascadestucson.com`, matching Lauren/Ashley/Zachary. - - JD Martin -- Syncro-confirmed contact (jd.martin@cascadestucson.com); Chef's Office user on CHEF-PC (his default printer = USB Chef Printer). - - Lupe Sanchez -- staff (DESKTOP-TRCIEJA). EOL workstation (Gateway ZX6971 AIO, i3-2120, 8 GB RAM, Win11 unsupported). **Decision 2026-06-18: replace machine** (dual-AV + EOL hardware causing slow Excel; no remediation on current box). GuruRMM agent `c9bf1a2d-bfdc-401e-9cc8-f9e90bb19587` (resolve live by hostname; UUIDs change on re-enroll). - - Tamra Matthews -- Move-In Coordinator (Marketing/Sales), SALES4-PC. **OFFBOARDED 2026-06-30** (left June 2026 -- see Access section). - - **Syncro contact emails (authoritative):** ashley.jensen@, jd.martin@, crystal.rodriguez@, John.trozzi@, meredith.kuhn@, accounting@/accountingassistant@cascadestucson.com. -- **Billing rate:** $175/hr all labor (prepaid block customer) -- **Hours remaining:** **37.5 hrs as of 2026-07-10 (live Syncro, unchanged since 2026-06-30).** Prior: 46.75 hrs as of 2026-06-26; 47.75 hrs as of 2026-06-25; 48.25 hrs as of 2026-06-24. Always live-check via `GET /customers/20149445` before billing. +- **Billing rate:** $175/hr all labor +- **Hours remaining:** **21.5 hrs as of 2026-07-15 (live Syncro)**. Always live-check via `GET /customers/20149445` before billing. - **Syncro customer ID:** 20149445 -- **Managed devices (Syncro assets):** 29 (live 2026-07-01) -- **Active tickets:** **0 open Syncro tickets as of 2026-07-10 (live Syncro).** See Active Work and session logs for ongoing project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). - - #110680053 / #32303 -- Entra / domain migration project. Status: **Invoiced** as of 2026-06-05. Plan: `C:\Users\Howard\.claude\plans\wise-discovering-panda.md` - - #109412123 -- Entra setup project (verify status) - - #32403 -- Meredith locked Word doc (0.5h remote, billed 2026-06-10, Invoiced) - - #32417 -- Shared mailboxes Grievances+Surveys (0.5h remote, billed 2026-06-12, Invoiced) - - #32444 -- Voice VLAN 30 + RF optimization (7h: 4 onsite + 3 remote, billed 2026-06-19, Invoiced) +- **Managed devices (Syncro assets):** 29 (live 2026-07-15) +- **Key contacts (Syncro authoritative):** + - Ashley Jensen -- Administrator (ashley.jensen@cascadestucson.com) + - John Trozzi -- Maintenance (John.trozzi@cascadestucson.com, 520-365-8200); facility liaison for Helpany + - Meredith Kuhn -- Assistant Manager (meredith.kuhn@cascadestucson.com, 520-886-3171). **NEVER set as ticket contact in Syncro** -- recurring wrong default. + - Chef JD Martin (jd.martin@cascadestucson.com, 520-822-4269) + - Jeff Bristol (accounting@cascadestucson.com) + - Crystal Rodriguez (crystal.rodriguez@cascadestucson.com) + - Dalila Sarabia (accountingassistant@cascadestucson.com) + - Tamra (971-777-9200) -- offboarded 2026-06-30 + - Bill Pay service (account-services@inform.bill.com) + - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC). Domain account `CASCADES\Shelby.Trozzi` (`OU=Care-Memorycare`, not Entra-synced). First password set + vaulted 2026-07-02. Has `\\CS-SERVER\Company Web Docs` mapped as `W:`, plus FullAccess+AutoMap on Alma Montt's converted shared mailbox. + - Chris Knight -- Accounting / Business Office (chris.knight@cascadestucson.com). Workstation: DESKTOP-N5G1ROO. Accounting mailbox FullAccess+SendAs granted 2026-07-09. + - Lauren Hasselman -- Accounting. Lupe Sanchez -- staff (DESKTOP-TRCIEJA, EOL, pending replacement). Karen Rossini, Sharon Edwards, Crystal Rodriguez -- staff. +- **Active tickets:** **0 open Syncro tickets as of 2026-07-15.** See session logs for active project work. --- @@ -265,148 +223,124 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn | Host | IP | Role | OS | Notes | |---|---|---|---|---| -| CS-SERVER | 192.168.2.254 | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009 hardware, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent ID: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolled; always resolve live by hostname, never hardcode the UUID). Clients reach SMB at **192.168.2.248** (registered DNS / Ethernet); .254 is the Hyper-V vEthernet NIC. **RAID HEALTHY per live OMSA 2026-06-24 -- see hardware note below.** **All legacy Datto software removed 2026-06-26 (was DattoAV/EDR/RMM leftover, not GravityZone); current Datto EDR (HUNTAgent) installed 2026-07-13.** | -| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | -- | Dell OOB interface | -| CS-QB (Hyper-V VM on CS-SERVER) | 192.168.2.228 | (label "VoIP server" -- STALE) | -- | **2026-06-16 recon: SMB/445 only, no SIP response -- NOT a live SIP PBX.** Phones appear cloud-registered (Vertical). Label predates the wireless-phone transition; revisit/retire. | -| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / legacy file storage | DSM 7.2.1-69057 | Port 5000 HTTP. Workgroup name is "CASCADES" -- same as AD short name, causing Kerberos auth failures from domain-joined machines. Slated to become backup-only. **Synology Drive Server 3.5.0-26088** (active, port 6690 SSL). Current Drive sync: CS-SERVER Drive Client (v7.5.0.16085, runs as sysadmin) syncs Sync-user My Drive (`/volume1/homes/Sync/Drive/`) -> `D:\Shares\Main` (one-way download). Real shared folders (Server 1.9 G, Management 5.5 G, Public ~50 G, SalesDept ~23 G, etc.) are NOT in scope -- Team Folder migration pending. | -| pfSense Firewall | 192.168.0.1 | Perimeter firewall, inter-VLAN routing, DHCP/DNS | pfSense Plus 25.07-RELEASE | Netgate device. cert CN=pfSense-685f277aa6886. Dual-WAN. All DHCP (CS-SERVER DHCP role has no scopes). 199 DHCP subnets (per-unit /28 VLANs, assisted-living L2 isolation). SSH shell access works from onsite (no interactive menu) but **tcp/22 is blocked from the OpenVPN subnet** -- use the GUI (443) remotely. Admin vault: `clients/cascades-tucson/pfsense-firewall`. OpenVPN user Howard: vault `clients/cascades-tucson/pfsense-openvpn-howard`. **Config vaulted 2026-06-17:** `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml`. pfSense is ZFS (power-loss resilient). Logs are PLAIN TEXT (not clog). | +| CS-SERVER | 192.168.2.254 (Hyper-V vEthernet); SMB at **192.168.2.248** | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolls -- resolve live by hostname). **RAID HEALTHY** (live OMSA 2026-06-24). **Datto EDR + Datto AV ACTIVE** (agent `b41befcf-e418-4d0d-8552-bc7662364d07`, heartbeat current, defs current; verified live 2026-07-15). Legacy Datto stack fully removed 2026-06-26; ACG-managed Datto EDR reinstalled 2026-07-13. | +| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | -- | Dell OOB. Service Tag **9MQFTK1**. | +| CS-QB (Hyper-V VM) | 192.168.2.228 | SMB/445 only -- NOT a live SIP PBX (2026-06-16 recon). Label "VoIP server" is stale. | -- | Revisit/retire. | +| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / onsite backup (planned repurpose, 60-90 days) | DSM 7.2.1-69057 | DS718+, ext4, 6 GB RAM, 2x WD10EZEX 1 TB. Port 5000 HTTP, Drive Server 6690 SSL. Workgroup "CASCADES" causes Kerberos auth failures from domain-joined machines. **Synology shared-folder syncs to CS-SERVER are SET UP AND WORKING** (Howard confirmed 2026-07-15). Drive Client (v7.5.0.16085) syncs shared folders to `D:\Shares\Main` on CS-SERVER. Planned: repurpose NAS as onsite backup for the server once migration completes (active plan item, 60-90 days). | +| pfSense Firewall | 192.168.0.1 | Perimeter firewall, inter-VLAN routing, DHCP/DNS | pfSense Plus 25.07-RELEASE | Netgate device. cert CN=pfSense-685f277aa6886. Dual-WAN. All DHCP (CS-SERVER DHCP role has no scopes). SSH/22 blocked from OpenVPN subnet -- use GUI (443) remotely. Admin vault: `clients/cascades-tucson/pfsense-firewall`. OpenVPN: `clients/cascades-tucson/pfsense-openvpn-howard`. Config vaulted point-in-time 2026-06-17: `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml`. Netgate AutoConfigBackup NOT yet enabled. Logs PLAIN TEXT on 25.07. | -**[CORRECTED 2026-06-24 -- LIVE OMSA] CS-SERVER RAID is HEALTHY, not degraded.** Dell PowerEdge R610 (Service Tag **9MQFTK1**), basic **SAS 6/iR Integrated** controller (3 Gbps, no cache), Status Ok. A live `omreport` query (Dell OMSA on CS-SERVER via RMM) shows **both virtual disks Ok/Ready and all 5 physical disks Online/Ok, Failure Predicted: No, all LEDs green.** The 2026-06-15 "degraded" state (PD 0:0:3 Critical/Removed) **self-recovered** -- the flaky consumer drive dropped out and re-synced after a power cycle (the ESM hardware log shows repeated drive remove/install events across the 6/17 + 6/23 outages). **Do NOT pull a drive -- there is nothing failed to swap.** +**CS-SERVER RAID detail (live OMSA 2026-06-24, healthy):** - **Live physical-disk map (OMSA, 2026-06-24):** - | ID | Size/Type | Make / Serial | Role | - |---|---|---|---| - | 0:0:0 | 1.2 TB SAS | Seagate ST1200MM0088 / Z400WHK8 | VD0 (D:) mirror member, Online | - | 0:0:1 | 1.2 TB SAS | Seagate ST1200MM0088 / S400RL2N | VD0 (D:) mirror member, Online | - | 0:0:2 | 320 GB SATA | Hitachi HTS545032B9A300 / …1DR | VD2 (C:) mirror member, Online | - | 0:0:3 | 320 GB SATA | WDC WD3200BEVT / WD-WXEX08URD116 | VD2 (C:) mirror member, Online (the 6/15 flaky drive) | - | 1:0:4 | 1.2 TB SAS | Seagate ST1200MM0088 / Z400WHML | **GLOBAL HOT SPARE** (protects the 1.2 TB D: mirror; do NOT remove) | +| ID | Size/Type | Make/Serial | Role | +|---|---|---|---| +| 0:0:0 | 1.2 TB SAS | Seagate / Z400WHK8 | VD0 (D:) mirror member | +| 0:0:1 | 1.2 TB SAS | Seagate / S400RL2N | VD0 (D:) mirror member | +| 0:0:2 | 320 GB SATA | Hitachi / 1DR | VD2 (C:) mirror member | +| 0:0:3 | 320 GB SATA | WDC WD3200BEVT / WXEX08URD116 | VD2 (C:) mirror member (was flaky 6/15, self-recovered) | +| 1:0:4 | 1.2 TB SAS | Seagate / Z400WHML | **GLOBAL HOT SPARE** -- do NOT remove | - - **VD0 = D: (1,117 GB RAID-1)** Ok; **VD2 = C: (297.5 GB RAID-1)** Ok. Windows sees only these 2 virtual disks. - - **1:0:4 is the GLOBAL HOT SPARE** (not "unused") -- matched to the D: mirror, gives it auto-rebuild protection. Pulling it strips D:'s safety net. It cannot rebuild the 320 GB C: mirror (size mismatch), so the C: mirror has no spare. - - **[WARN] PSU redundancy lost** (ESM log "Power supply redundancy is lost") -- one of the dual PSUs isn't delivering; check cords/feeds/LEDs onsite. - - **Planned (NOT emergency) reliability upgrade:** replace the two consumer 320 GB drives (0:0:2 Hitachi + 0:0:3 WD, esp. the flaky WD) with **2x enterprise SATA SSD (already purchased)** on a scheduled window with a confirmed image/system-state backup. DC migration off the 16-yr-old R610 remains the real long-term fix. - - **LESSON:** the prior "[CRITICAL] degraded -- replace drive" flag was a 9-day-stale snapshot; acting on it (SSDs purchased) before a live check was premature. Always pull live OMSA/iDRAC before drive action. +- VD0 = D: (1,117 GB RAID-1) Ok; VD2 = C: (297.5 GB RAID-1) Ok. +- **[WARN] PSU redundancy lost** (ESM log "Power supply redundancy is lost") -- one PSU not delivering; check cords/feeds/LEDs onsite. Note per Howard 2026-07-15: likely just not connected, not an active work item. +- **Planned reliability upgrade:** replace the two consumer 320 GB drives (0:0:2, 0:0:3) with 2x enterprise SATA SSD already purchased, on a scheduled window with confirmed backup. Service Tag 9MQFTK1. -**[INFO] Backup -- gap closed (2026-06-15); verified running 2026-06-24.** Mike installed ACG cloud backup (MSP360/CloudBerry -> ACG-backup server) on CS-SERVER, addressing the longstanding SS164.308(a)(7) "no backup" HIPAA gap. **Live check 2026-06-24:** last run (6/24 00:10) = "Plan status: Success", 0 failed; 575.7 GB / 248k-file dataset already in the cloud (only 465 MB changed -> full baseline exists, incrementals working). **Still to confirm: this looks FILE-LEVEL, not image/bare-metal/system-state -- for a DC that is a DR gap; confirm with Mike whether a separate image/system-state backup exists before treating it as full disaster coverage.** Set/confirm retention. +**Backup:** +- **MSP360/CloudBerry cloud backup on CS-SERVER** -- file-level backup plan last success 2026-07-15 07:00 (daily, verified live). Image-based plan last success 2026-07-05. Installed 2026-06-15 (closes HIPAA SS164.308(a)(7) gap). Retention confirm still pending. +- **Planned:** Synology NAS repurposed as onsite backup target for CS-SERVER (60-90 days, per tech plan). +- **Netgate AutoConfigBackup NOT yet enabled** (pfSense config vaulted 2026-06-17 as point-in-time only). -**[INFO] Endpoint security -- Datto EDR/AV is the ACG-managed stack (migration off Bitdefender substantially complete).** Cascades migrated from Syncro-deployed **Bitdefender GravityZone BEST** to **Datto EDR + Datto AV** (Infocyte/azcomp4587.infocyte.com). Datto EDR org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. **State as of 2026-06-26:** ~34 agents enrolled. Datto EDR installed on 7 machines 6/25 (org 27->34). **Bitdefender REMOVED from RECEPTIONIST-PC** (both physical boxes, serials MJ0KQH4R + MJ0KQHNP) via GravityZone console "Uninstall client" task -- the GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall, so removal is **console-only**. 6 orphaned `C:\Program Files\Bitdefender` folders deleted (safety-checked). **RECEPTIONIST-PC is two distinct physical machines sharing a hostname** -- dedup-by-hostname masks the second box. **Straggler pass 2026-06-26:** BD-checked reconnected machines -- DESKTOP-MD6UQI3, Laptop4, SALES4-PC all NO_BITDEFENDER (clean); **DESKTOP-TRCIEJA = BD_ACTIVE** (needs the GravityZone console uninstall; slated for replacement anyway). NurseAssist got its queued EDR install confirmed (agent `23c3c36e`, AV on, v3.17.1.5552) after its Home->Pro upgrade. DESKTOP-F94M8UT (Alma Montt's, powered off) BD-aware EDR install queued (cmd `a4623704`, auto-fires on reconnect); DESKTOP-KQSL232 (Lois Lane's old box) decommissioned -- removed from list. **CS-SERVER's endpoint AV was DattoAV, NOT GravityZone Bitdefender** (see SMB/AV pattern) -- all legacy Datto software fully removed from CS-SERVER 2026-06-26, which left the DC with NO managed endpoint protection until **Datto EDR (Infocyte HUNT agent) was installed on CS-SERVER 2026-07-13** (RMM cmd `0a60cac7`, precheck clean, HUNTAgent=Running, org `2d5ea96e`, key `6qw68y2rwl`). **Pending:** DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro's Bitdefender deployment (GUI-only) so BD doesn't redeploy; GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records; reconcile `laptop3` (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop. - -**[WARN] Power outage (2026-06-17):** Building power outage took the entire Cascades network down. Root cause: pfSense was plugged into the **surge-only side of the UPS** (no battery) -- it hard-powered-off uncleanly. ZFS survived. Dirty boot caused a **duplicate dhcpd** and a **2nd-floor switch (USL24PB, 192.168.2.193) with one-way L2 forwarding** blocking DHCP OFFERs. Howard killed the duplicate dhcpd remotely; Mike re-seated pfSense onto battery outlets, restored config from on-box auto-backup (12:20 version, VLAN30 intact), reset+re-adopted Switch 2nd Floor #2. Network fully restored. Post-recovery casualties: devices that booted during DHCP-down window cached disconnected state (kitchen thermal printer fixed by power-cycle). Incident report: `clients/cascades-tucson/reports/2026-06-17-power-outage-incident.md`. - -**[INFO] Planned power outage (2026-06-23, 05:30-09:00 MST) -- clean shutdown executed:** Building-wide electrical work scheduled a 3.5h power cut. To avoid a repeat of the 6/17 dirty-shutdown damage, all three core devices were armed the prior evening (2026-06-22 ~19:06) to **shut THEMSELVES down** on self-contained local schedules -- CS-SERVER (Windows task `ACG-PlannedOutage-Shutdown` -> stop CS-QB VM -> `Stop-Computer`, 05:28), Synology (`/sbin/poweroff`, 05:28), pfSense (`shutdown -p now`, 05:30) -- so they fired independent of any remote session or the OpenVPN tunnel, with the UPS carrying them through the 05:30 cut. **Verified clean (2026-06-23 05:31 MST):** CS-SERVER confirmed offline via GuruRMM cloud at last_seen 05:29:49 MST; pfSense + Synology unreachable as expected. Pre-flight (2026-06-22) verified: cloud backup last full SUCCESS @ 6/22 00:11 (0 errors); iDRAC AC Power Recovery ON + Synology auto-restart ON; John Trozzi onsite for physical power-on ~09:00. Bring-up bottom-up: pfSense first -> switches/APs re-adopt -> CS-SERVER -> Synology -> straggler sweep. Runbook: `clients/cascades-tucson/docs/runbooks/2026-06-23-planned-power-outage.md`. +**Endpoint security:** +- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack.** Org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. 35 agents enrolled, all AV-enabled, 28 online (2026-07-15). Install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`. +- **CS-SERVER:** Datto EDR/AV active (agent `b41befcf`, heartbeat current, defs current). Legacy Datto stack removed 2026-06-26; ACG-managed EDR reinstalled 2026-07-13 (RMM cmd `0a60cac7`). +- **Long-stale agents:** desktop-kqsl232 (47d offline -- decommissioned), maintenance-pc (26d offline). +- **Bitdefender decommission substantially complete.** DESKTOP-TRCIEJA still BD_ACTIVE (GravityZone console-only uninstall; retires with planned hardware replacement). DESKTOP-F94M8UT: removed from Datto console (gone as of 2026-07-15 verification). Pending: confirm Cascades removed from Syncro's BD deployment (GUI-only); GravityZone portal cleanup of stale RECEPTIONIST-PC records (company `66b0448e`); reconcile laptop3 (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop. ### Email & Identity - **M365 tenant:** cascadestucson.com | Tenant ID: `207fa277-e9d8-4eb7-ada1-1064d2221498` -- **M365 license:** **Business Premium (SPB, SKU `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`) -- 45 seats enabled / 45 consumed / 0 free** (as of 2026-06-30; Howard bought 11 more seats on 6/30 and all 40 caregivers consumed seats -- was 34 enabled / 3 consumed). Business Premium includes Entra ID P1 (required per-user by the caregiver CA lockdown). **Legacy Office 365 Business Standard (O365_BUSINESS_PREMIUM) -- SUSPENDED** (0 enabled / 37 suspended). Relicensing the remaining suspended-Standard users onto Business Premium is pending. (Tamra Matthews' O365 Business Standard seat was freed on offboarding 2026-06-30; Alma Montt's SPB seat was freed 2026-06-25.) -- **On-prem AD domain:** cascades.local | UPN suffix: cascadestucson.com (added 2026-04-13 for Entra Connect SSO readiness) -- **MX / mail flow:** Exchange Online (M365). SPF: `v=spf1 a mx ip4:72.194.62.5 include:spf.protection.outlook.com include:spf-0.secureserver.net -all`. DKIM: both M365 selectors published. DMARC: `p=quarantine;pct=100` -- upgraded from p=none. Reports to `info@cascadestucson.com` (unmonitored). No third-party email gateway (EOP direct MX). -- **MFA:** CA policy "Require MFA for all users" is enabled. Caregiver bypass in progress -- caregivers cannot satisfy MFA (no personal device), so three scoped CA policies use BLOCK instead. Voice-call MFA is **disabled tenant-wide** (SMS + Authenticator are the allowed methods). Exception: security group "MFA - Voice Call Scoped (sysadmin)" (id `304f941e-3594-4705-b8e6-ee676297df11`, single member `sysadmin@`) has Voice method enabled. -- **Entra Connect:** Installed on CS-SERVER 2026-04-25. Exited staging 2026-05-14 -- actively syncing (last sync confirmed 2026-05-27). `SG-Caregivers` is an on-prem AD group synced via Entra Connect -- **cloud/Graph group adds fail (HTTP 400); all membership writes must be done on-prem (CS-SERVER via RMM).** OU=Administrative not yet in sync scope; UPN suffix updates for Administrative OU users pending before that OU can be added. -- **Break-glass accounts:** Two planned (`breakglass1-csc@cascadestucson.com`, `breakglass2-csc@cascadestucson.com`). Confirmed not yet created as of 2026-05-27. FIDO2 YubiKeys ordered -- arrival unconfirmed. +- **M365 licenses (live Graph 2026-07-15):** + - Business Premium (SPB): 45 owned / **41 assigned** / 4 free + - Business Standard: **SUSPENDED** -- ~30 office staff still on it; 29 consumed (jodi.ramstack removed 2026-07-15). Relicensing these users onto supported licenses is a 30-day to-do (~$375-575/mo net-new spend, not savings -- 26 net-new seats; best case ~$374/mo after converting shared mailboxes). Not everyone needs full Office. +- **On-prem AD domain:** cascades.local | UPN suffix: cascadestucson.com +- **MX / mail flow:** Exchange Online (EOP direct MX). SPF: `-all`. DKIM: both M365 selectors published. DMARC: `p=quarantine; pct=100` (live, verified 2026-07-15). Reports to `info@cascadestucson.com` (unmonitored). No third-party email gateway. +- **MFA:** CA policy "Require MFA for all users" enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth). Voice-call MFA disabled tenant-wide; exception: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`, single member `sysadmin@`). +- **Entra Connect:** Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. `OU=Administrative` not yet in scope (UPN suffix updates for that OU pending). **Cloud/Graph group adds to `SG-Caregivers` fail (HTTP 400) -- all membership writes on CS-SERVER via RMM.** +- **Break-glass accounts:** `breakglass1-csc@cascadestucson.com`, `breakglass2-csc@cascadestucson.com`. **Not yet created as of 2026-07-15.** Must exist before the final CA allow-list flip. - **Admin accounts:** - - `admin@cascadestucson.com` -- Mike's working admin (cloud-only, Connect-excluded by design) - - `sysadmin@cascadestucson.com` -- Howard's working admin (cloud-only, Connect-excluded by design). Object id: `471b13dc-3cf8-416b-a132-f5f3bc8d1cc8`. Vaulted at `clients/cascades-tucson/m365-sysadmin.sops.yaml`. -- **ALIS (clinical SaaS):** https://cascadestucson.alisonline.com -- Entra SSO live and working. communityId 622. Install key: `d796539d-356b-4190-9c17-35f0f1129376`. Vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml` (API user cred: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` -- username must be tenant-qualified `howard.enos@cascadestucson`). ALIS application ID `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, client secret expires 2028-05-06 (rotation reminder -- expiry breaks ALIS SSO tenant-wide). Per-caregiver: ALIS staff-record Email must match Entra UPN exactly. Staff endpoints are **read-only via API -- writes are done by uploading a `build-import` .xls in the ALIS UI.** BAA with Medtelligent not yet verified. - - **Admin consent (2026-06-03):** Tenant-wide admin consent (`AllPrincipals` `User.Read`) granted on ALIS Entra service principal (`e1cae4ad-5beb-44ca-82d4-434c9bd835ad`). This resolved `AADSTS65001` sign-in failures. - - **How to enable ALIS SSO for one user:** (1) Tenant-wide admin consent already done globally. (2) In ALIS admin -> Staff -> user's record, set **Email = exact Entra UPN**. (3) User signs in via "Sign in with Microsoft." (4) Turn off ALIS-native 2FA (Entra is the second factor; native 2FA conflicts and locked out Karen Rossini). - - **Login model confirmed (2026-06-30):** no local ALIS password is required for SSO users -- authentication is fully delegated to Microsoft/Entra. When building an ALIS staff-import (`alis` skill `build-import`), set **Login Enabled = Yes** with **Email = the user's UPN** and **leave Password blank**. The import builder auto-defaults Login Enabled to No when no password is present, so SSO rows must set Login Enabled = Yes explicitly or the account won't be able to sign in at all. - - **Diagnostic signature:** a user with zero ALIS-app sign-in events in Entra sign-in logs is still on the old direct-login path -- fix is the ALIS Email match, not anything in Entra. -- **Caregiver phones:** 22 Samsung Galaxy A15s enrolled in Intune Shared Device Mode (SDM). Enrollment profile: `CSC - Android Shared Phones (Entra SDM)` (`9a0fcc6d`); 25 devices enrolled per 2026-06-03 Intune pull. Dynamic group: `Cascades - Shared Phones` (`ea96f4b7`). Android enrollment token expires 2027-05-08 -- expiry does NOT unenroll existing devices. **Caregiver identities now licensed + grouped + temp-passworded for phone SSO (2026-06-30) -- see Entra Access Architecture.** + - `admin@cascadestucson.com` -- Mike's working admin (cloud-only, Connect-excluded) + - `sysadmin@cascadestucson.com` -- Howard's working admin (cloud-only, Connect-excluded). Object id: `471b13dc-3cf8-416b-a132-f5f3bc8d1cc8`. Vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml`. +- **ALIS (clinical SaaS):** https://cascadestucson.alisonline.com. communityId 622. Vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` (username must be `howard.enos@cascadestucson`). ALIS app id `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, client secret expires **2028-05-06** (rotation reminder -- expiry breaks ALIS SSO tenant-wide). Staff endpoints are read-only via API -- writes via `alis` skill `build-import` -> upload .xls in ALIS UI. +- **jodi.ramstack DECOMMISSIONED 2026-07-15:** account disabled, sessions revoked, Business Standard license removed (user id `b7cddbeb-6026-436b-a3aa-67c4be43e3fb`). No mailbox existed (deprovisioned by the suspended subscription; last sign-in 2025-03-28). Account object retained disabled/unlicensed. - **Audit retention:** Approved 2026-04-29. Azure Log Analytics (90d) + Storage Account (6yr) in ACG subscription `e507e953-2ce9-4887-ba96-9b654f7d3267`, RG `rg-audit-cascadestucson`. **Not yet built.** -- **Inky:** No Inky deployment exists in this tenant. Confirmed 2026-06-04. -- **EXO MSP app auth note (2026-06-04):** When the MSP app cert is not in the Windows cert store, use client_credentials flow to obtain an EXO-scoped access token and connect via `Connect-ExchangeOnline -AccessToken`. App: ComputerGuru Exchange Operator (`b43e7342-5b4b-492f-890f-bb5a4f7f40e9`). Vault: `msp-tools/computerguru-exchange-operator.sops.yaml`. -- **Shared mailboxes (created 2026-06-12):** `grievances@cascadestucson.com` and `Surveys@cascadestucson.com` -- both SharedMailbox type, cloud-only, no license consumed. Delegated to Meredith Kuhn and Ashley Jensen with FullAccess (auto-mapping) + SendAs on each. All 8 permission grants verified. Ticket #32417. -- **`accounting@cascadestucson.com` ("Accounting Dept.")** -- SharedMailbox, cloud-only, account disabled (normal for shared). **Delegates (verified 2026-07-09): Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight** -- each holds FullAccess (auto-mapping) + SendAs. Chris Knight added 2026-07-09 to match Lauren's tier. Note `accountingassistant@` is a separate **UserMailbox**, not a delegate of this one. - - **Grant pattern (EXO REST `InvokeCommand`, `exchange-op` tier):** `Add-MailboxPermission -Identity accounting@ -User -AccessRights FullAccess -InheritanceType All -AutoMapping $true`, then `Add-RecipientPermission -Identity accounting@ -Trustee -AccessRights SendAs`. AutoMapping is what makes the mailbox self-attach in the user's Outlook profile (AutoDiscover refresh; restart Outlook to force). **Verification gotcha:** an immediate `Get-RecipientPermission` read-back can miss the new SendAs trustee (replication lag across EXO replicas) -- re-read before concluding the write failed. SendAs itself can take ~60 min to replicate before sending stops bouncing. +- **[SECURITY -- OPEN]** `ComputerGuru - Tenant Admin` SP holds a standing **Privileged Authentication Administrator** role (stranded from Alma Montt offboarding; Graph blocked teardown). Needs a Global Admin to remove in Entra (Roles & admins -> PAA -> remove SP). Leave its Conditional Access Administrator role. Pending Mike's decision. +- **Shared mailboxes (live state):** + - `grievances@cascadestucson.com`, `Surveys@cascadestucson.com` -- created 2026-06-12; Meredith Kuhn + Ashley Jensen, FullAccess+SendAs. + - `accounting@cascadestucson.com` ("Accounting Dept.") -- delegates: Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight (added 2026-07-09), each FullAccess (auto-mapping) + SendAs. + - Alma Montt's mailbox -> SharedMailbox (Shelby Trozzi FullAccess+AutoMap, 2026-06-25). + - Tamra Matthews' mailbox -> SharedMailbox (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen FullAccess+AutoMap, 2026-06-30). +- **Inky:** No deployment exists. Confirmed 2026-06-04. +- **HIPAA BAA:** Covered by Microsoft Customer Agreement for Business plan subscribers (confirmed 2026-05-14). Medtelligent (ALIS) BAA not yet verified. ### Network -- **ISP / WAN:** Dual-WAN Cox. WAN1 igc0 `184.191.143.62/30` (Cox Fiber, primary, gateway `184.191.143.61`) + WAN2 igc3 `72.211.21.217/27` (Cox Coax, secondary, static); `WAN_Group` gateway group; both active full-duplex, no loss events (verified 2026-06-16). Both WAN IPs added as Cascades Named Location in Entra (ID: `061c6b06-b980-40de-bff9-6a50a4071f6f`). **Measured bandwidth (2026-06-18):** WAN1 fiber **upload ~522 Mbps**; RRD 3-day peaks ~680 Mbps down / 98 Mbps up (actual usage). WAN2 coax upload **unmeasured** (remote source-route test failed -- needs a WAN2-routed host or the Cox bill). 30 calls ~= 3 Mbps vs ~522 Mbps fiber headroom -> **the WAN is NOT the everyday voice bottleneck** (RF is); voice QoS is insurance for WAN2 failover + rare WAN1 saturation. -- **Firewall:** pfSense Plus **25.07-RELEASE** (Netgate) at `192.168.0.1`, cert CN=pfSense-685f277aa6886. Admin vault: `clients/cascades-tucson/pfsense-firewall`. SSH shell access works onsite (no interactive menu) but **tcp/22 is blocked from the OpenVPN subnet -- use the GUI (443) remotely** (the unifi-wifi `pfsense-ssh.sh` skill silently returns empty over VPN). OpenVPN user Howard: vault `clients/cascades-tucson/pfsense-openvpn-howard` (split-tunnel; `route 192.168.0.0/22`; use OpenVPN GUI or OpenVPN Connect with DCO disabled for stability). **Logs are PLAIN TEXT on 25.07 -- read with tail/grep, NOT clog.** pfSense has an **OpenVPN `--inactive` idle timeout (~300s)** on the server; it disconnects clients after ~5 min of no tunnel data (keepalive pings do NOT reset this counter). Fix proposed 2026-06-18; not applied. **[ROUTING GOTCHA 2026-06-30] The LAN "Default allow LAN to any" rule has Gateway = WAN_Group (dual-WAN policy routing), which shoves LAN->internal-VLAN traffic (e.g. CS-SERVER -> VLAN 20 printers) OUT THE WAN.** This is NOT a firewall block. Fixed with a top LAN pass rule: source CS-SERVER `192.168.2.248`, dest `10.0.20.0/24`, Gateway = default -- restores full server access to VLAN 20 (printers etc.) without matching resident/guest ingress. **[OUTAGE 2026-06-17] pfSense was on UPS surge-only side -- moved to battery-backed outlets by Mike. On-box auto-backup restored; config vaulted. Enable Netgate AutoConfigBackup to prevent future off-box gap.** - - **[INFO] pfSense health check (2026-06-16):** gateway ruled out as WiFi factor -- DHCP not exhausted, unbound DNS up, both WANs full-duplex/stable, firewall states 28-31k/790k, load 0.6. -- **LAN / VLAN layout:** Primary staff/AP network `192.168.0.0/22` (pfSense .0.1, cascadesDS .0.120, UniFi APs + most WiFi clients on 192.168.2.x/3.x). DHCP pool 192.168.2.2-192.168.3.254 (~507 cap, ~270 active ~53%). Per-unit /28 VLANs: **199 DHCP subnets** total, mostly `10.x.y.0/28` per apartment (assisted-living L2 isolation) + **Staff/Internal VLAN 20** ("CSCNET", `10.0.20.0/24`, gw `10.0.20.1` -- the target VLAN staff machines + printers are being migrated onto, off the flat old LAN "CSC ENT" 192.168.0.0/22) + Guest VLAN 50 (`10.0.50.0/24`, RFC1918 blocked) + **Voice VLAN 30** (`10.0.30.0/24`, gw `10.0.30.1`). DHCP backend: ISC (Kea config present, dormant). Unbound DNS. **Note: VLAN 20 is NOT an isolated VLAN template** -- its only user rule is `opt238net -> lan`; other traffic rides a floating `pass inet all` catch-all (the Guest VLAN 50 four-rule block pattern is the isolation template, not VLAN 20). - - **[STATUS 2026-07-01] CSC ENT -> VLAN 20 migration -- machines essentially done, printers lagging.** Live GuruRMM reconcile: **22 online hosts now on VLAN 20** (10.0.20.x); only CS-SERVER (stays by design) + ~6 stragglers (ASSISTMAN-PC, CascadesProxess, Laptop2, NurseAssist, 2 roaming laptops) remain on 192.168.x. Printer shares lag well behind: only **4 of 15** CS-SERVER print shares are repointed to 10.0.20.x. Full detail in Patterns & Known Issues (Printers / VLAN 20 Migration) and `docs/printer-gpo-map.md`. -- **Switching:** Full UniFi. **77 U7-Pro APs** + **12 managed switches** (1st Floor USW-48 PoE core; floors 2-4 USW-Pro-24-PoE; MemCare USW-Pro-24-PoE; USW Lite 8 PoE; USW-16-PoE VoIP switch). **[WARN] ~25 switch ports linked at 100 Mbps but gig-capable** (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches; investigate after WiFi Phase A). 3 offline switches: Switch 2nd Floor #2, Switch 4th Floor #2, USW Pro Max 16. PoE budgets healthy. Port p38 (1st Floor USW) 4.0% tx-drop rate. All managed on the shared UOS controller (172.16.3.29, HTTPS 11443; see [[uos-server]]); Cascades site short name `va6iba3v`, site_id `685f39068e65331c46ef6dd2`. **Mesh topology:** 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108. Note: Switch 2nd Floor #2 (USL24PB, 192.168.2.193) was reset+re-adopted after the 2026-06-17 power outage. -- **WiFi SSIDs:** - - **CSCNet -- shared PPSK SSID.** `private_preshared_keys_enabled`; ~230-242 per-key->network mappings (most keys -> per-room resident VLANs 101-631; a few -> Default; one phone key -> Internal/VLAN 20; one voice PPSK -> VOICE/VLAN 30). ~1,190 historical clients (residents' IoT/TVs, staff, phones). **Do NOT repoint the SSID to move a subset of clients** -- move at the PPSK level. wlanconf `685f39078e65331c46ef7ee5`; cred vault `clients/cascades-tucson/wifi-cscnet.sops.yaml`. - - CSC ENT -- legacy SSID, main LAN (192.168.0.0/22), being deprecated as migration proceeds (planned to become the permanent 5 GHz-only WPA2 "device island" for Poly voice + Helpany sensors -- see VoIP/network section) - - Guest -- isolated, VLAN 50 -- **Wireless RF status (applied 2026-06-19 -- ~587 concurrent clients):** - - **2.4 GHz is the primary pain band:** avg TX-retry ~10%, cu_total 69-94% live, catastrophic external neighbor BSSID density (ch6 ~33k BSSIDs, ch1 ~19k, ch11 ~17k). 27 of the 40 worst clients on 2.4 GHz (retry 11-42%), mostly IoT/legacy. Root cause: extreme radio density; external saturation limits benefit of any 1/6/11 channel re-plan. - - **2.4 GHz power -> MEDIUM (APPLIED 2026-06-19, validated, kept):** 42 over-thinned-`low` radios floors 1-4 + 5 MemCare floors-5/6 `auto`/full radios (505/517/608/615/622) -> Medium. 24 thinned-disabled radios stayed disabled; 5 mesh-auto APs untouched. Non-regressive. Corrected the 2026-06-17 over-thinning regression (retry had risen to 23.4% at Low). **Remaining 2.4 levers (deferred):** min-RSSI on 6 APs currently OFF (615, 608, 505, 517, 622, salon); 1/6/11 channel re-plan (marginal against external density). - - **5 GHz: clean DFS 40 MHz plan APPLIED (2026-06-19) -- retry HALVED.** 72 non-mesh APs on channels {52,60,100,108,116,124,132,140}, 0 co-channel pairs. **Result: retry 8.7->3.8 avg (median 8.2->2.1, ~half).** Validated: all 72 APs holding DFS, 0 radar vacates, satisfaction median 99. Mesh APs (2nd Floor Atrium, CC Bridge, salon, 108) left on auto. **DFS channels at this site are 4-5x cleaner than non-DFS** (2-3% busy vs ch149=12%, ch157=28%, ch44=22%); the earlier "non-DFS only" recommendation was reversed by measured survey data (74/74 APs). `dfs-check.sh` 2026-06-16 + nightly: **ZERO real radar events fleet-wide.** Safety net: UniFi auto-vacates one AP on a radar hit; follow-up = recurring `dfs-check.sh` monitor. - - **6 GHz BLOCKED on CSCNet:** 75 radios active but only ~1 client. Root cause: CSCNet `wlan_bands=[2g,5g]` (not broadcasting 6g); enabling 6 GHz on WPA2/PPSK SSID requires WPA3+PMF conversion (`Wpa3MandatoryFor6GHzBand`), touching all 427 clients. **Largest untapped clean capacity.** Deferred to Howard's supervised decision on the SSID security conversion. - - **CSCNet BSS-transition (802.11v): ON** (applied 2026-06-19). - - **3 AM AP auto-upgrade: OFF** (left off after overnight run; re-enable when ready). - - **AP 103 saturated (5 GHz):** ch149 at 75% airtime, ~25,900 retries, 12 clients -- was Lauren's locked AP. With the DFS 40MHz plan applied, ch149 is now assigned elsewhere on the fleet; AP 103's channel should have changed. Verify load post-settle. - - **AP-level satisfaction 95-100 fleet-wide.** Pain is in the client tail (IoT stuck on 2.4). - - **AP 108 (Floor 1) offline** pending a new cable run. Stale duplicate controller object ("108" vs "108U7 Pro") to clean up separately. -- **VoIP (vendor: Vertical -- Richard Turner ):** Two phone fleets -- **8 AudioCodes** (OUI `00:90:8f`, WIRED on USW-16-PoE ports 1-8, externally powered / PoE OFF) and **Poly** (OUI `48:25:67`, WiFi via CSCNet PPSK) -- **28 active** (29 re-keyed 2026-06-19, 1 removed bad). **All on VOICE VLAN 30: 28 Poly + 8 AudioCodes (`.224-.231`) + Vertical desktop (`.201`) = 37 devices.** Phones mark **DSCP EF (46)**. **[2026-06-19 hardware change] John (Trozzi) reported the Kitchen server phone (`48:25:67:64:95:7a`) BAD and pulled it; the Bistro phone (`.236`, `48:25:67:64:94:84`) was relocated to the Kitchen to cover it -- so the BISTRO now has NO phone (replacement pending, set up + re-key when it arrives).** (Verify VLAN via the client `vlan` field, NOT the cached display IP.) The **Vertical-Remote management desktop** (`10.0.30.201`, MAC `e4:e7:49:52:3a:06`, WIRED USW-16-PoE port 16, VOICE VLAN 30, **DHCP** -- confirmed not static, LogMeIn remote access, no pfSense OpenVPN) is live on VLAN 30. No on-prem SIP PBX found -> phones appear to register to a **cloud/hosted PBX** (Vertical). -- **[2026-06-19 COMPLETE] Voice VLAN (VLAN 30) consolidation:** dedicated isolated **VLAN 30 VOICE (`10.0.30.0/24`, gw `10.0.30.1`, pfSense igc1.30, DHCP `.100-.250`, DNS `8.8.8.8/1.1.1.1`)** holding ALL phones + the Vertical desktop; internet/cloud-PBX egress only, firewalled off VLAN 20 / main LAN / PHI / mgmt (HIPAA). Voice PPSK key on CSCNet -> VOICE: vaulted `clients/cascades-tucson/wifi-voice-ppsk`. **Migration COMPLETE 2026-06-19: 37 devices on VOICE.** Live inventory: `docs/network/voice-phone-inventory.md`. - - **Quality caveat + the actual fix (2026-06-19):** the VLAN move does NOT by itself fix call quality. Per-phone re-look found residual dropped-calls are a **band-selection problem, not RF/coverage** -- several Poly handsets sit on saturated 2.4 GHz despite EXCELLENT 5 GHz-capable signal (-50 to -60 dBm, 36-96% retry), and controller band-steering (`no2ghz_oui`, already ON) is NOT holding the Poly OUI on 5 GHz. **The fix is a dedicated 5 GHz network, not phone-side band pinning** -- Richard Turner (Vertical/Poly, 2026-06-24) confirmed Poly phones **cannot** be statically assigned to a band; Poly recommends a **separate 5 GHz SSID** (or disabling band steering on a shared SSID). - - **[PLAN 2026-06-24] CSC ENT device-island consolidation** (Howard + Mike): the phone 5 GHz fix is now merged with the Helpany sensor rollout into one plan -- **repurpose the existing CSC ENT SSID as a 5 GHz-only WPA2 PPSK "device island"** carrying BOTH the Poly voice handsets (PPSK key -> VLAN 30) and the Helpany "Paul" radar sensors (PPSK key -> new VLAN 40), separated at the VLAN layer. Both vendors transition their devices remotely once we hand them the network. Helpany is **WPA2-only** (no WPA3/hybrid) and the Pauls are already on CSC ENT (key `Ftfd85710#`), so they are **not reprogrammed** -- only band-moved; the phones get a new voice key. **Onsite gate:** verify per-room 5 GHz coverage before the band flip (steel walls; weak-5 GHz devices stay on 2.4 per both vendors' warning). **CSC ENT is NOT deleted** -- it becomes the permanent WPA2 island, which is the prerequisite that later lets **CSCNet** move to WPA3/WiFi7/6 GHz (that step is separately gated by the ~230 resident 2.4-only/WPA2-only IoT clients, NOT by the voice/sensor gear). Full design + sequence: `docs/network/csc-ent-device-island-plan.md`; folded into `docs/REMAINING-WORK-PLAN.md` Workstream 6. - - **Full runbook:** `clients/cascades-tucson/docs/network/voice-vlan-cutover.md`. Voice-quality diagnostic: `reports/2026-06-18-voice-quality-diagnostic.md`. Holistic optimization plan: `docs/network/network-optimization-master-plan.md`; voice QoS design: `docs/network/phase1-voice-qos-design.md`. +- **ISP / WAN:** Dual-WAN Cox. WAN1 igc0 `184.191.143.62/30` (Cox Fiber, primary, gw `184.191.143.61`) + WAN2 igc3 `72.211.21.217/27` (Cox Coax, secondary, static). `WAN_Group` gateway group. Measured: WAN1 ~522 Mbps upload; WAN2 coax upload unmeasured. +- **Firewall:** pfSense Plus 25.07-RELEASE at `192.168.0.1`. Admin vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml`. Split-tunnel OpenVPN (Howard): `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (route `192.168.0.0/22`; use OpenVPN GUI or OpenVPN Connect with DCO disabled). **[ROUTING GOTCHA 2026-06-30]** LAN "Default allow LAN to any" rule Gateway=WAN_Group policy-routes LAN->internal-VLAN traffic out the WAN. Fixed with a top LAN pass rule (src CS-SERVER `192.168.2.248`, dst `10.0.20.0/24`, gw=default). pfSense OpenVPN `--inactive` idle timeout ~300s (not yet fixed). +- **LAN / VLAN layout:** Primary staff/AP network `192.168.0.0/22`. **Staff/Internal VLAN 20** ("CSCNET", `10.0.20.0/24`, gw `10.0.20.1`). **Voice VLAN 30** (`10.0.30.0/24`, gw `10.0.30.1`). **Guest VLAN 50** (`10.0.50.0/24`, RFC1918 blocked). **CSC Internal VLAN 10** (mgmt). Per-unit /28 VLANs: ~240 networks (VLANs 101-631 for per-room resident isolation, `10.[floor].[room].0/28`). DHCP backend: ISC (Kea config present, dormant). Unbound DNS. +- **[STATUS 2026-07-01] VLAN 20 migration -- machines essentially done, printers lagging.** 22 online hosts on VLAN 20 (10.0.20.x); only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x. Printer shares: only **4/15** repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); the other 11 still point at old-LAN IPs. MCMedTech stale at 192.168.2.53 (target 10.0.20.74 live+reachable). GPO `CSC - Point and Print (CS-SERVER)` pilot-scoped to DESKTOP-H6QHRR7 only. Map: `docs/printer-gpo-map.md`. +- **Switching (live 2026-07-15):** 11 switch objects in UniFi (8 online, 2 offline USL24PB -- "Switch 2nd Floor #2" and "Switch 4th Floor #2" -- **offline by design, not an issue**, Howard confirmed 2026-07-15; 1 USPM16P pending). **~25 switch ports at 100 Mbps but gig-capable** (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches). 34 active 100Mb switch ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240 -- highest-impact). Port p38 (1st Floor USW) 4.0% tx-drop rate. Full UniFi managed via UOS controller (172.16.3.29, HTTPS 11443; Cascades site `va6iba3v`, site_id `685f39068e65331c46ef6dd2`). +- **WiFi -- 77 U7-Pro APs (75 online, 2026-07-15).** CSCNet (shared PPSK, ~230-242 per-key->network mappings, wlanconf `685f39078e65331c46ef7ee5`, vault `clients/cascades-tucson/wifi-cscnet.sops.yaml`). CSC ENT (legacy, being repurposed as 5 GHz-only WPA2 PPSK "device island" for Poly voice + Helpany sensors). Guest (isolated, VLAN 50). Mesh topology: 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108. +- **Wireless RF (applied 2026-06-19, validated):** 2.4 GHz -> MEDIUM power on 47 radios (non-regressive; corrected over-thinning regression). 5 GHz -> clean DFS 40 MHz plan on 72 non-mesh APs (ch 52/60/100/108/116/124/132/140, 0 co-channel) -- retry HALVED (8.7->3.8 avg). CSCNet BSS-transition (802.11v) ON. 6 GHz BLOCKED on CSCNet (WPA3 mandate; Howard's supervised decision to enable). DFS channels at this site 4-5x cleaner than non-DFS (survey-proven); never apply a non-DFS-only policy without measuring first. +- **Voice VLAN 30 (COMPLETE 2026-06-19):** HIPAA-isolated VLAN 30 (`10.0.30.0/24`). 37 devices: 28 Poly phones + 8 AudioCodes (`.224-.231`) + Vertical desktop (`10.0.30.201`, MAC `e4:e7:49:52:3a:06`, wired, LogMeIn). Phones mark DSCP EF (46). Voice PPSK vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml`. Bistro phone replaced Kitchen server phone (bad, pulled 2026-06-19) -- Bistro now has no phone (pending replacement). QoS design ready (`docs/network/phase1-voice-qos-design.md`) but NOT built; blocker: WAN2 coax upload figure. +- **VoIP vendor: Vertical (Richard Turner rturner@vertical.com).** Two phone fleets: 8 AudioCodes (wired, externally powered, PoE OFF) + 28 Poly (WiFi via CSCNet PPSK). Vertical manages phones remotely. Dropped-calls root cause is RF band selection (Poly on saturated 2.4 GHz); CSC ENT device-island plan is the fix (dedicate 5 GHz SSID for Poly + Helpany). Poly cannot statically select a band -- a separate 5 GHz SSID is required (confirmed by Richard Turner 2026-06-24). ### External Vendors & Mail Senders -- **Helpany (resident safety sensors -- Sandro Cilurzo CEO / Eugenie Nicoud COO):** "Paul" devices are **ceiling-mounted radar fall/motion sensors** (Sedimentum backend) -- **no camera, no microphone** (despite being colloquially called "IR cameras"). WiFi: **WPA2-only, NOT WPA3/hybrid**; 5 GHz-capable. Currently on SSID **CSC ENT** (key `Ftfd85710#`), being moved to 5 GHz (see CSC ENT device-island plan in the VoIP/network section). Bandwidth negligible: <0.04 Mbps/device, fleet peak ~1.35 Mbps. Egress to `*.sedimentum.com` (5671 AMQPS, 8883 MQTT, 8030 HTTP, 443) + snapcraft/ubuntu (443). Helpany transitions devices **remotely** (engineering); key rotation needs **72 h notice + new key**; reprogramming offline devices is hard. Rolled out floor-by-floor from 2026-06 (first shipment floors 1-2). Caregiver-facing app = app.safe-living.com (branded "Helpany"). Facility liaison: John Trozzi. -- **bill.com (BILL):** Sends from `inform.bill.com`, `hq.bill.com`, `hello.bill.com`, `mc.bill.com`. MX via pphosted.com (Proofpoint). Confirmed delivering successfully to meredith.kuhn, ashley.jensen, lauren.hasselman, zachary.nelson as of 2026-06-04. Safe sender: `account-services@inform.bill.com`. -- **BOK Financial:** Sends from `bokfinancial.com`. MX via pphosted.com (Proofpoint). DMARC p=reject. Zero emails to any cascadestucson.com user in 90-day history as of 2026-06-04 (likely wrong recipient address on BOK's side for the accounts in question). +- **Helpany (resident safety sensors):** "Paul" = ceiling-mounted radar fall/motion sensors (Sedimentum backend, no camera/mic). WiFi: **WPA2-only, NOT WPA3/hybrid**; 5 GHz-capable. Currently on CSC ENT (key `Ftfd85710#`), migrating to the 5 GHz device-island. Facility liaison: John Trozzi. +- **bill.com (BILL):** Sends from `inform.bill.com`, `hq.bill.com`, `hello.bill.com`, `mc.bill.com`. Safe sender: `account-services@inform.bill.com`. Confirmed delivering to accounting staff. +- **BOK Financial:** DMARC p=reject; zero historical emails to cascadestucson.com (wrong recipient address on BOK's side). ### Business Applications & Reporting Systems -Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of, per Ashley Jensen 2026-06-17). Most are niche senior-living products: - -| System | Function | Data-out path | +| System | Function | Notes | |---|---|---| -| **ALIS** (Medtelligent) | Clinical EHR (census/clinical) | Vendor reporting/export; API TBD. **HIPAA -- BAA required before PHI leaves it.** Their most important source. SSO live (see Entra section). | -| **QuickBooks** | Accounting | QBO = API + connectors; Desktop = ODBC | -| **Bill.com** | AP/AR | REST API (most automatable) -- see mail-sender note above | -| **Relias** | Training / LMS | Reporting export / API (completion data) | -| **You've Got Leads** | Senior-living CRM | Reporting/export; API varies | -| **TELS** (Direct Supply) | Facilities management | Reporting export; API uncertain | -| **Focus HR** | HR / payroll | Export or vendor API (plan-dependent) | -| **Helpany** (app.safe-living.com) | Caregiver app | Niche -- likely export-only | -| **POS** | Point of sale | Product TBD | +| ALIS (Medtelligent) | Clinical EHR | SSO live. HIPAA -- BAA required before PHI leaves. communityId 622. | +| QuickBooks | Accounting | Running on CS-SERVER (should NOT be on a DC). | +| Bill.com | AP/AR | REST API automatable. | +| Relias | Training / LMS | Export / API. | +| You've Got Leads | Senior-living CRM | Export / API varies. | +| TELS (Direct Supply) | Facilities | Export; API uncertain. | +| Focus HR | HR / payroll | Export or vendor API. | +| Helpany (app.safe-living.com) | Caregiver app | Export-only likely. | +| POS | Point of sale | TBD. | -- **[PROPOSED] Unified KPI dashboard (Ashley Jensen request, 2026-06-17):** single dashboard pulling KPIs across the systems above. Recommended path: **Phase 1** scheduled CSV/Excel exports -> SharePoint -> Power BI Pro dashboard; **Phase 2** automate the API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Power BI on-prem Gateway is the WRONG frame (bridges only on-prem DBs, not cloud SaaS). Internal scoping: `clients/cascades-tucson/docs/proposals/kpi-dashboard.md`; client one-pager: `.../kpi-dashboard-onepager.md`. Status: parked, awaiting Ashley's day-one KPIs + freshness need + POS/Focus-HR specifics + ALIS analytics availability. +**[PROPOSED] KPI dashboard (Ashley Jensen request, 2026-06-17):** Phase 1 scheduled CSV/Excel exports -> SharePoint -> Power BI Pro; Phase 2 API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Parked pending Ashley's day-one KPIs + data-freshness need + POS/Focus-HR specifics + ALIS analytics availability. Scoping: `clients/cascades-tucson/docs/proposals/kpi-dashboard.md`. --- ## Access -- **CS-SERVER:** Via ScreenConnect or GuruRMM (live agent ID `c39f1de7-d5b6-45ae-b132-e06977ab1713` as of 2026-06-30; re-enrolls -- resolve live by hostname, do not hardcode). Vaulted domain-admin cred: `clients/cascades-tucson/cs-server.sops.yaml` (username `sysadmin`). +- **CS-SERVER:** Via ScreenConnect or GuruRMM (agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`; re-enrolls -- resolve live by hostname). Vault: `clients/cascades-tucson/cs-server.sops.yaml` (username `sysadmin`). - **CS-SERVER iDRAC:** 192.168.2.65 - **pfSense admin (HTTPS):** https://192.168.0.1 -- vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml` -- **pfSense SSH:** `ssh admin@192.168.0.1` (system OpenSSH; drops to shell directly, no interactive menu) -- **tcp/22 blocked from the OpenVPN subnet; use the GUI remotely** -- vault admin cred: `clients/cascades-tucson/pfsense-firewall.sops.yaml`; pfsense-ssh.sh (unifi-wifi skill) for scripted access onsite. -- **pfSense OpenVPN (Howard):** split-tunnel; vault: `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (user `Howard`; route 192.168.0.0/22). Use OpenVPN GUI or OpenVPN Connect with DCO disabled for stability. Howard-Home is 10.137.42.0/24 (renumbered 2026-06-16). Server has a configured `--inactive` idle timeout (~300s) that silently drops idle clients. +- **pfSense SSH:** `ssh admin@192.168.0.1` (system OpenSSH) -- **tcp/22 blocked from OpenVPN subnet; use GUI remotely** +- **pfSense OpenVPN (Howard):** vault: `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (split-tunnel, route `192.168.0.0/22`) - **pfSense config backup (2026-06-17):** `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml` -- **Synology DSM:** http://192.168.0.120:5000 -- vault: `clients/cascades-tucson/synology-cascadesds.sops.yaml` (admin). Drive Server port 6690 (SSL). **[SECURITY] Synology Cloud Signin Portal credential (`clients/cascades-tucson/synology-signin-portal.sops.yaml`) was committed plaintext at vault commit 1fbc0e1 -- exposed in git history; encrypted go-forward but credential should be rotated.** +- **Synology DSM:** http://192.168.0.120:5000 -- vault: `clients/cascades-tucson/synology-cascadesds.sops.yaml`. **[SECURITY]** Cloud Signin Portal credential was committed plaintext at vault commit 1fbc0e1 -- encrypted go-forward but **must be rotated.** - **M365 admin:** admin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-admin.sops.yaml` -- **Shelby Trozzi (domain account `CASCADES\Shelby.Trozzi`):** vault `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Password set on-prem 2026-07-02 (never-expires, no change-at-logon) -- she had never logged in (`logonCount = 0`). **Safe to reset on-prem: not Entra-synced** (no `ConsistencyGuid`; `OU=Care-Memorycare,OU=Departments` is outside Entra Connect sync scope), so an AD reset does not touch M365. Note AD complexity rejects passwords containing the user's own name. - **M365 sysadmin:** sysadmin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml` - **WiFi CSCNet:** vault: `clients/cascades-tucson/wifi-cscnet.sops.yaml` - **WiFi Voice PPSK (VLAN 30):** vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml` +- **Android enrollment token:** vault: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml` - **MDM service account:** vault: `clients/cascades-tucson/mdm-service-account.sops.yaml` -- **svc-scan (scan-to-folder service account):** vault: `clients/cascades-tucson/svc-scan.sops.yaml`. AD account on CS-SERVER for the Accounting Brother's SMB scans. -- **ALIS SSO app registration:** vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; ALIS API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml`. -- **Caregiver AD temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` (40 caregiver AD temp passwords, all forced-change-at-next-login; keys = sAMAccountName). Hybrid PHS -> these are also the M365/phone sign-in. Retrieve with `vault get` (NOT get-field -- dotted keys). Do NOT inline any values. -- **Caregiver AD temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml` (a.vallejo, j.munezero, n.cota, k.robinson; keys = sAMAccountName, `vault get` not get-field). Same hybrid PHS behavior as above. Do NOT inline any values. -- **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key` -- SSH/Mongo access for `unifi-wifi` skill and `uos-mongo.sh`. Vaulted 2026-06-15 by Mike. -- **UOS controller RW admin (Network API):** vault: `infrastructure/uos-server-network-api-rw` -- required to apply any radio/config changes. Vaulted 2026-06-15 by Mike. -- **UniFi AP device auth (Cascades):** vault: `clients/cascades-tucson/unifi-ap-ssh` -- direct AP SSH via site VPN (needed for `watch-ap.sh` live stream; L3 reach to 192.168.2.x/3.x via split-tunnel VPN). Vaulted 2026-06-15 by Mike. -- **UOS controller (HTTPS):** https://172.16.3.29:11443 (HTTPS 11443, not 8443) -- site `va6iba3v` / site_id `685f39068e65331c46ef6dd2` -- **GuruRMM -- RECEPTIONIST-PC (frontdesk box, serial MJ0KQHNP):** agent `2e8d8b73-82f6-4151-a3ce-879c55de4b82` (front desk). The Memory Care box (serial MJ0KQH4R, agent `57f19e17-8792-46cc-b9fd-f1909836cd17`) shares the hostname -- **rename to MEMCARE-STATION STAGED 2026-06-30** (applies on next reboot). -- **GuruRMM -- ASSISTMAN-PC (Meredith Kuhn):** agent ID `cf86fa5e-96a2-494d-9cb1-8be22a518ad0` -- **GuruRMM -- DESKTOP-TRCIEJA (Lupe Sanchez):** agent ID `c9bf1a2d-bfdc-401e-9cc8-f9e90bb19587` (resolve live by hostname; UUIDs change on re-enroll) +- **svc-scan (scan-to-folder):** vault: `clients/cascades-tucson/svc-scan.sops.yaml` +- **ALIS SSO app registration:** vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` +- **Caregiver temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. Retrieve with `vault get` (NOT `get-field`). Do NOT inline values. +- **Caregiver temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`. Same retrieval rules. +- **Shelby Trozzi (domain account):** vault: `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Not Entra-synced (safe to reset on-prem without M365 impact). +- **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key` +- **UOS controller RW admin (Network API):** vault: `infrastructure/uos-server-network-api-rw` +- **UniFi AP device auth (Cascades):** vault: `clients/cascades-tucson/unifi-ap-ssh` - **Remediation tool:** Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator (`bfbc12a4`), Exchange Operator (`b43e7342`), User Manager (`64fac46b`), Tenant Admin (`709e6eed`), Defender Add-on, Intune Manager. -- **[SECURITY -- OPEN 2026-06-25] Tenant Admin SP holds a STANDING Privileged Authentication Administrator (PAA) role.** During Alma Montt's offboarding the `ComputerGuru - Tenant Admin` SP was JIT-elevated to PAA to reset her password; Graph then blocked the automatic teardown ("removing self from built-in role is not allowed"), leaving the role assigned. Needs a Global Admin to remove in Entra (Roles & admins -> Privileged Authentication Administrator -> remove the SP); **leave its standing Conditional Access Administrator role (intentional)**. Pending Mike's decision (coord message sent 2026-06-25). Recommended posture: keep JIT, fix the teardown so resets stop stranding PAA. -- **Alma Montt -- OFFBOARDED 2026-06-25** (terminated; MC Life Enrichment; no PHI/ALIS access). M365 sign-in blocked, 0 licenses, mailbox -> SharedMailbox (Shelby Trozzi FullAccess+AutoMap), hidden from GAL, groups removed; on-prem AD disabled + moved to `OU=Excluded-From-Sync`. No litigation hold (no PHI). Verified live end-to-end and reconciled out of all active plans/rosters. Emergency password: vault `clients/cascades-tucson/alma-montt` (do NOT re-enable without authorization). Record: `docs/security/offboarding-2026-06-25-alma-montt.md`. -- **Tamra Matthews -- OFFBOARDED 2026-06-30** (Move-In Coordinator, Marketing/Sales; left June 2026). M365 object `2d9cf0d1-2b0b-424e-9cd1-91eaac408837` was **cloud-only** (single O365 Business Standard license) -- sessions revoked, sign-in blocked, password reset+vaulted, mailbox -> SharedMailbox (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen all FullAccess+AutoMap), hidden from GAL, license removed (seat freed), removed from `Sales`/`All Cascades`/`SG-SSPR-Eligible`. On-prem `Tamra.Matthews` (separate non-synced object in OU=Marketing) disabled + moved to `OU=Excluded-From-Sync`. **No litigation hold despite PHI-adjacent (resident-intake) role** -- Howard authorized the Alma-style preserve-but-no-hold posture (documented in the record; hold remains available -- tenant has Exchange Plan 2). Emergency passwords: vault `clients/cascades-tucson/tamra-matthews` (m365_password + ad_password; do NOT re-enable without authorization). Record: `docs/security/offboarding-2026-06-30-tamra-matthews.md`. ALIS profile disable pending (Howard, if she had one). Follow-up: breach check on Megan Hiatt (April CREDENTIAL_STUFFING marker -- verify the April remediation held). -- **ComputerGuru Exchange Operator MSP app:** `b43e7342-5b4b-492f-890f-bb5a4f7f40e9` -- vault: `msp-tools/computerguru-exchange-operator.sops.yaml`. -- **Vault root:** `clients/cascades-tucson/` in vault repo +- **Vault root:** `clients/cascades-tucson/` --- @@ -414,268 +348,198 @@ Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of, ### Syncro / Billing -- **Never set a contact on any Syncro ticket unless explicitly requested.** At Cascades, Meredith Kuhn is the recurring wrong default that Syncro pre-selects -- she is not the correct contact. Leave `contact_id` blank. Source: `feedback_syncro_blank_contact.md`. +- **Never set a contact on any Syncro ticket unless explicitly requested.** Meredith Kuhn is the recurring wrong default Syncro pre-selects -- she is not the correct contact. Leave `contact_id` blank. - **Billing product for prepaid block draw:** Use a real labor type (Remote, Onsite, etc.) -- NOT "Prepaid project labor" (exempt, won't decrement the block). -- **Always live-check hours before billing:** `GET /customers/20149445` in Syncro. Treat all cached hour counts as approximate. -- **Windows Home->Pro upgrade billing:** Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine); machine-named lines + optional labor. MAK: vault `infrastructure/windows-pro-mak.sops.yaml`. +- **Always live-check hours before billing:** `GET /customers/20149445`. +- **Windows Home->Pro upgrade billing:** Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine). MAK: vault `infrastructure/windows-pro-mak.sops.yaml`. ### Exchange Online / Message Tracing -- **Get-MessageTrace is hard-deprecated (Sept 2025).** Use `Get-MessageTraceV2` instead. Key parameter change: use `ResultSize` (not `PageSize`). The deprecation error may be silently swallowed by downstream jq filters -- if a trace returns unexpectedly empty, check the raw response for a deprecation error string before assuming no mail. -- **Sender-side suppression (SendGrid ESP):** If a user never receives mail from a specific sender despite a healthy mailbox, and message trace shows zero records (not even bounces), consider a SendGrid suppression list. Fix requires contacting the sender's support -- there is no M365 action. Confirmed with bill.com / inform.bill.com. -- **AutoMapping rolls back on rapid sequential grants.** Granting FullAccess with `AutoMapping:$true` to several delegates in a rapid loop can silently lose the middle writes -- they contend on the same `msExchDelegateListLink` multivalued attribute on the target mailbox and a failed link-write aborts the whole `Add-MailboxPermission`. **Fix:** grant one user at a time, spaced ~6-8s, `Remove-MailboxPermission` -> poll-until-NONE -> `Add-MailboxPermission -AutoMapping $true` -> verify-persists. The REST Exchange Operator schema does not expose `msExchDelegateListLink`, so use grant-persistence as the success signal. (Tamra Matthews offboarding 2026-06-30.) +- **Get-MessageTrace is hard-deprecated (Sept 2025).** Use `Get-MessageTraceV2` instead (`ResultSize` not `PageSize`). V2 max window 10 days -- loop 9 consecutive windows for 90-day coverage. Deprecation error may be silently swallowed by downstream jq filters -- check the raw response if trace returns unexpectedly empty. +- **Sender-side suppression (SendGrid ESP):** If a user never receives mail from a specific sender and message trace shows zero records, consider a SendGrid suppression list (fix = contact sender's support, no M365 action). Confirmed with bill.com. +- **AutoMapping rolls back on rapid sequential grants.** Grant one user at a time, spaced ~6-8s; poll until removed before the next grant. (Tamra Matthews offboarding root cause, 2026-06-30.) +- **Get-RecipientPermission replication lag:** an immediate read-back after a SendAs grant can miss the new trustee (EXO replica lag); re-read before concluding the write failed. (Chris Knight accounting mailbox, 2026-07-09.) ### Active Directory / User Management -- **Security group assignment is always explicit.** When creating or adding any Cascades user, always ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14. -- **`SG-Caregivers` = frontline caregivers ONLY** (Howard 2026-06-30). Admin-adjacent staff (e.g. Veronica Feller in OU=Care-Assisted Living, Christine Nyanzunda in OU=Care-Memorycare), `pilot.test`, and disabled accounts are EXCLUDED -- this reverses the earlier 6/4 plan to add Feller/Nyanzunda. -- **`SG-Caregivers` is an on-prem AD group synced by Entra Connect.** Cloud/Graph adds fail (HTTP 400). Do all membership writes on CS-SERVER via RMM (`Add-ADGroupMember`). -- **Entra Connect sync scope for caregiver objects is narrow -- do not OU-move a synced caregiver.** Confirmed 2026-07-01: sync scope covers ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. Moving a caregiver account to any other OU (e.g. front desk / Administrative) would delete its cloud object. When a caregiver's role changes, remove them from `SG-Caregivers` in place and leave the OU alone until the destination OU enters sync scope (Zeke Huerta, front desk, 2026-07-01). -- **Caretaker roster reconciliation against a client-provided list is a standard cycle** (last run 2026-07-01): pull live `OU=Caregivers` + `SG-Caregivers` via RMM, diff 1:1 against the client's list, then per Howard's per-person decisions -- disable + remove-from-group + reclaim license for leavers, create + group + license + temp-password for new hires, and resolve any name duplicates (e.g. the Lassey dup, keep the account the client actually uses). License math and CA-policy exclusions ride on `SG-Caregivers` membership, so this reconciliation is also the license/CA source of truth. - +- **Security group assignment is always explicit.** When creating any Cascades user, ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14. +- **`SG-Caregivers` = frontline caregivers ONLY** (Howard 2026-06-30). Admin-adjacent staff (Feller, Nyanzunda), `pilot.test`, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400); all writes on CS-SERVER via RMM. +- **Entra Connect sync scope is narrow -- do not OU-move a synced caregiver.** Scope covers ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. Moving a caregiver to any other OU deletes its cloud object (Zeke Huerta, front desk role change, 2026-07-01 -- OU move deferred). +- **Caretaker roster reconciliation is a standard cycle** (last run 2026-07-01): pull live `OU=Caregivers` + `SG-Caregivers` via RMM, diff 1:1 against the client's list, per-person decisions (disable+remove+reclaim for leavers; create+group+license+temp-password for new hires; resolve name duplicates). License math and CA policy exclusions ride on `SG-Caregivers` membership. - **New user mandatory order (folder redirection):** 1. Create AD user - 2. Run `New-HomeFolder -Username ""` on CS-SERVER (creates root + Desktop/Documents/Downloads/Music/Pictures with correct ACL) + 2. Run `New-HomeFolder -Username ""` on CS-SERVER 3. Add to SG-FolderRedirect 4. THEN first domain logon - Skipping step 2 causes fdeploy to cache a failure silently and never retry. - -- **Folder redirect recovery:** If fdeploy cached a failure ("No changes detected"), run `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys. Folders must already exist on server. - -- **fdeploy1.ini flags:** Changed from `Flags=1211` (included `Grant Exclusive Rights` bit 0x400, causing WRITE_DAC failures on new subfolders) to `Flags=187`. - -- **[ROOT CAUSE + FIX 2026-06-08] Native Folder Redirection was DOA on every machine -- the config file was MISNAMED.** Root cause: the redirect targets in GPO `CSC - Folder Redirection` (`{512B43A4-...}`) were saved in a file named **`fdeploy1.ini`**, but the Windows Folder Redirection CSE only ever reads **`fdeploy.ini`**. **Fix:** wrote a correct `fdeploy.ini` (5 folders, `Flags=187`, `FullPath=\\CS-SERVER\Homes\%USERNAME%\`) into `{512B43A4-...}\User\Documents & Settings\`, bumped the GPO version 917506->983042 (GPT.INI **and** AD `versionNumber` kept in sync). **Native FR now redirects all 5 folders on first logon.** - - **LE GPO also broken:** `CSC - Folder Redirection (LE)` (`{889BE7BE-...}`, linked at OU=Life Enrichment) has a **completely empty `\User` tree**. Sharon Edwards / Susan Hicks have likewise only ever worked via the registry workaround. Follow-up: retire the LE GPO and put LE users into `SG-FolderRedirect`, or apply the same `fdeploy.ini` fix to the LE GPO. - -- **Login-screen hide (SpecialAccounts\UserList):** An enabled local admin that does not appear in the Windows sign-in picker is a `SpecialAccounts\UserList` suppression, not a disabled account. Registry path: `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList`, value `=0`. Fix: delete the DWORD value. +- **Folder redirect recovery:** `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys. +- **fdeploy1.ini flags:** `Flags=187` (changed from 1211 which caused WRITE_DAC failures on new subfolders). +- **[ROOT CAUSE 2026-06-08] Native Folder Redirection was DOA fleet-wide** -- GPO targets were in `fdeploy1.ini` but the Windows FR CSE only reads `fdeploy.ini`. Fixed by writing correct `fdeploy.ini` + version bump. Native FR now works on first logon. +- **`LE` GPO (`{889BE7BE-...}`) has empty `\User` tree** -- Sharon Edwards / Susan Hicks working via registry workaround only. Follow-up: retire the LE GPO and put LE users into `SG-FolderRedirect`. +- **Login-screen hide (`SpecialAccounts\UserList`):** An enabled local admin not visible in the sign-in picker has a `SpecialAccounts\UserList` suppression (DWORD `=0`). Fix: delete the DWORD. +- **Caregiver name change procedure (Charity Menle, 2026-07-09):** `Set-ADUser` -> `Rename-ADObject` -> `Set-ADUser -SamAccountName` -> delta `Start-ADSyncSyncCycle`. Set `proxyAddresses` explicitly. Password and group/license unchanged. Vault: temp password stays under the OLD sAMAccountName key. ### File Shares & Scan-to-Folder (Accounting) -- **Accounting department folder + scan dropbox (built 2026-06-09):** - - `D:\Shares\Accounting` on CS-SERVER -- inheritance broken; SYSTEM / BUILTIN\Administrators = Full; `lauren.hasselman`, `chris.knight`, `zachary.nelson` = Modify (no Everyone). Shared as **`\\CS-SERVER\AcctDept`** (Change: those 3 users + `svc-scan`; Full: Admins). - - **Share is named `AcctDept`, NOT `Accounting`** -- a *printer* share named `Accounting` (Canon MF455DW, `LocalsplOnly`) already exists. Do not collide with it. - - **`svc-scan`** = dedicated AD service account (CN=Users, PasswordNeverExpires, CannotChangePassword) for the Brother's SMB auth. Vault: `clients/cascades-tucson/svc-scan.sops.yaml`. - - **REUSE `svc-scan` for EVERY future scanner->network-folder setup at Cascades** (Howard, 2026-06-09) -- do NOT create a per-printer/per-folder scan account. -- **Brother MFC-L8900CDW "Business Office" printer (10.0.20.220) -- Scan-to-Network profile (working 2026-06-09):** Network Folder Path `\\192.168.2.254\AcctDept\Scans`; **Auth Method NTLMv2** (not Auto/Kerberos -- printer can't KDC across VLAN); Username `cascades\svc-scan`; PDF Multi-Page. -- **[CORRECTED 2026-06-24, live] CS-SERVER CAN reach VLAN 20 -- server-hosted printing to VLAN-20 printers works.** CS-SERVER routes to `10.0.20.0/24` via the default gateway (pfSense `192.168.0.1`) and **pings the VLAN-20 gateway `10.0.20.1` fine**. The VLAN-20 print queues already on the server print through it. **Caveat:** the printers often **don't answer ICMP ping when asleep** (and 9100 may show closed while idle) -- that is NOT a firewall block; a real print job wakes them. **[REFINED 2026-06-30] The one real block was policy-routing, not the firewall:** the LAN "allow LAN to any" rule's Gateway=WAN_Group sent CS-SERVER->VLAN 20 out the WAN. A top LAN pass rule (src 192.168.2.248, dst 10.0.20.0/24, gw=default) fixed it -- see pfSense Operations. -- **Persistent drive maps to `\\cs-server\AcctDept`:** Chris (DESKTOP-N5G1ROO) Y:, Zachary (ACCT2-PC) Y:, Lauren (DESKTOP-H6QHRR7) X:. -- **`\\CS-SERVER\BusinessOffice` (Business Office - Brother L8900CDW, `10.0.20.220`) = the "Accounting Assistant" printer in room 101** -- one physical L8900CDW, already a shared print queue on CS-SERVER. Attached to Chris Knight's PC (DESKTOP-N5G1ROO) 2026-06-24. Do NOT create a duplicate "Accounting Assistant Printer" queue -- it's this one. -- **`\\CS-SERVER\Company Web Docs` (built 2026-07-02):** `D:\Shares\Public\Company Web Docs`, shared for Shelby Trozzi (MemCare Director). **Gated at the SHARE ACL, not NTFS** -- `CASCADES\Shelby.Trozzi` = Change, `BUILTIN\Administrators` = Full; NTFS left as inherited `Everyone:FullControl` from `Public`. The new share is the only network path to the folder, so the share ACL is the effective gate and the `Public` NTFS tree stays undisturbed. Effective access = Change. Share name intentionally contains spaces. - - **Mapping it via RMM does not work directly** -- `user_session` impersonation has no network credential for the outbound SMB hop to CS-SERVER (error 67 / RPC 1702, the documented artifact above). Workaround that DOES work: store the credential with `cmdkey`, then plant a persistent map in the user's hive at `HKCU:\Network\` (RemotePath/UserName/ProviderType 131072); it reconnects at their next interactive logon. For immediate visibility, map it in a live interactive session (ScreenConnect). Reusable pattern -- memory `reference_rmm_map_network_drive`. -- **Executive restricted share (built 2026-06-24, ticket #32193):** `D:\Shares\Executive` on CS-SERVER, shared as **`\\cs-server\Executive`**; inheritance broken; SYSTEM / BUILTIN\Administrators = Full; `CASCADES\Ashley.Jensen` + `CASCADES\Meredith.Kuhn` = Modify (no Everyone); share-access limited to the same two + Admins. Mapped persistent `E:` on DESKTOP-U2DHAP0 (Ashley) and ASSISTMAN-PC (Meredith), RW-verified. NOTE: clients reach CS-SERVER SMB at **192.168.2.248** (registered DNS / Ethernet idx16), NOT the .254 Hyper-V vEthernet NIC. RMM dispatch gotcha: build UNC from `[char]92` (heredoc+jq eats `\\`->`\`); surface a remotely-mapped drive in the user's running Explorer with `SHChangeNotify(SHCNE_DRIVEADD)` in their session. +- **Accounting folder:** `D:\Shares\Accounting` on CS-SERVER, shared as `\\CS-SERVER\AcctDept`. **Share is named `AcctDept`, NOT `Accounting`** (a printer share named `Accounting` already exists; do not collide). Users: lauren.hasselman, chris.knight, zachary.nelson (Modify). `svc-scan` for scanner auth (Change). **REUSE `svc-scan` for every future scanner->network-folder setup at Cascades** -- do NOT create a per-printer/per-folder scan account. Vault: `clients/cascades-tucson/svc-scan.sops.yaml`. +- **Brother MFC-L8900CDW "Business Office" (10.0.20.220):** Scan-to-Network profile: path `\\192.168.2.254\AcctDept\Scans`, **Auth Method NTLMv2** (not Auto/Kerberos -- printer can't KDC across VLAN), username `cascades\svc-scan`. +- **Drive maps:** Chris Knight (DESKTOP-N5G1ROO) Y:; Zachary (ACCT2-PC) Y:; Lauren (DESKTOP-H6QHRR7) X: -- all to `\\CS-SERVER\AcctDept`. +- **`\\CS-SERVER\Company Web Docs` (built 2026-07-02):** `D:\Shares\Public\Company Web Docs`, gated at share ACL (Shelby.Trozzi = Change; Admins = Full; NTFS left inherited from `Public`). RMM cannot push the drive map directly (`user_session` double-hop -> SMB error 67); workaround: `cmdkey` + persistent `HKCU:\Network\W` map (mounts at next logon). Reusable pattern: memory `reference_rmm_map_network_drive`. +- **`\\CS-SERVER\Executive` (built 2026-06-24):** `D:\Shares\Executive`, inheritance broken; Ashley.Jensen + Meredith.Kuhn = Modify. Persistent E: on DESKTOP-U2DHAP0 (Ashley) + ASSISTMAN-PC (Meredith). Note: CS-SERVER SMB clients reach it at **192.168.2.248** (registered DNS), NOT .254 (Hyper-V vEthernet). +- **RMM dispatch gotcha:** build UNC from `[char]92` in PowerShell payloads -- literal `\\` collapses to `\` through jq/agent. +- **`\\CS-SERVER\BusinessOffice` = the Accounting Assistant printer (Canon MF455DW, `10.0.20.220`) in room 101.** One physical L8900CDW, one share. Do NOT create a duplicate "Accounting Assistant Printer" queue. -### Printers / VLAN 20 Migration (2026-06-30) +### Printers / VLAN 20 Migration -- **Server-share model is preferred** (Howard) for domain-joined machines: `\\CS-SERVER\` print queue rather than direct-IP. **Workgroup (not-yet-domain-joined) machines get a direct-IP local printer installed as SYSTEM (machine-wide/all users)** -- no share, no domain auth, no point-and-print prompt -- switch to `\\CS-SERVER\` once domain-joined. -- **Point-and-Print policy is the correct "apply our admin rights" fix** for standard users pulling a driver from CS-SERVER (NOT making users local admins). Symptom without it: mapping elevation prompt `0x800702e4` and per-machine `/ga` silently failing at logon (PrintService event 513 / error 0xBCB) -- both are the default `RestrictDriverInstallationToAdministrators` blocking the driver pull. Set `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers`: `RestrictDriverInstallationToAdministrators=0` + subkey `PointAndPrint` (`Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2`), scoped to CS-SERVER. Caregiver machines already have this (why their printer GPO works); this is the prerequisite layer a printer-deployment GPO needs fleet-wide. -- **Canon MF741CDW / MF743CDW are UFR II ONLY -- NOT PCL.** A PCL6 driver produces **Error #822** (spools but nothing prints). CS-SERVER only staged PCL6/PS3/XPS; pulled `Canon Generic Plus UFR II V250` (INF `cnlb0ma64.inf`) from a client DriverStore to CS-SERVER (client -> `\\CS-SERVER\C$`, since CS-SERVER off-subnet can't reach a client's C$). -- **Static VLAN 20 printer IPs (2026-06-30):** Front Desk Epson ET-5800 = `10.0.20.221` (share `\\CS-SERVER\FrontDesk`); Life Enrichment Canon MF741CDW = `10.0.20.94` (share `\\CS-SERVER\LifeEnrichment`, **UFR II**; sharon.edwards + susan.hicks, default stays Copy Room); Business Office Brother L8900CDW = `10.0.20.220`; Dining Room Canon MF743CDW = `10.0.20.228` (DESKTOP-MD6UQI3, direct-IP UFR II); Chef Office Brother MFC-9330CDW = `10.0.20.236` (CHEF-PC, direct-IP; JD Martin's default stays USB Chef Printer); MedTech Brother MFC-L8900CDW = `10.0.20.74` (memcare box + DESKTOP-LPOPV30/Karen); MC Reception Epson ET-5800 = `10.0.20.78` (MEMREct-PC, not yet set up). Running map: `docs/printer-gpo-map.md`. -- **[PLANNED] Printer GPO:** put the Point-and-Print policy in a fleet-wide computer GPO; repoint `CSC - Life Enrichment Printers` GPO to `\\CS-SERVER\LifeEnrichment` (old ref `1F-132-RecRoom-Canon`); build per-room printer-deployment items as machines domain-join. `CSC - Printer Deployment` is the known disabled/empty/reference-only GPO. Howard floated packaging the migration how-to (VLAN routing/pfSense bypass, server-share repoint, Point-and-Print, UFR II, [char]92 UNC) into a reusable Cascades printer skill. - -**[LIVE RECONCILE 2026-07-01] Migration is further along than the 6/30 docs captured -- full GuruRMM fleet + CS-SERVER printer-state pull:** -- **Machines: essentially migrated.** 22 online hosts confirmed on VLAN 20 (10.0.20.x): ACCT2-PC, ANN-PC, ASSISTNURSE-PC, CHEF-PC (workgroup), CRYSTAL-PC, DESKTOP-DLTAGOI, DESKTOP-H6QHRR7 (P&P pilot), DESKTOP-LPOPV30, DESKTOP-MD6UQI3 (workgroup), DESKTOP-N5G1ROO, DESKTOP-ROK7VNM, DESKTOP-TRCIEJA, Health-Services-Director, LAPTOP-DRQ5L558, MAINTENANCE-PC, MDIRECTOR-PC, MEMRECEPT-PC (workgroup), NURSESTATION-PC, RECEPTIONIST-PC frontdesk (.102, S/N MJ0KQHNP), RECEPTIONIST-PC memcare (.68, S/N MJ0KQH4R), SALES4-PC, megan. Only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x: ASSISTMAN-PC (.2.38), CascadesProxess (.2.178), Laptop2 (.2.118), NurseAssist (.3.254), LAPTOP-8P7HDSEI (.3.101, roaming), LAPTOP-E0STJJE8 (.3.9, roaming). Offline/last-known: DESKTOP-F94M8UT (10.0.20.171), DESKTOP-U2DHAP0 (192.168.3.37, seen 2026-07-01), DESKTOP-KQSL232 (decommissioned), Laptop4 (no DNS record). -- **Printer shares: still only 4/15 on VLAN 20** -- FrontDesk (.221), BusinessOffice (.220), LifeEnrichment (.94), MCReception (.78) are done; the other 11 (NursesPrinter, HealthServices, MCDirector, CopyRoom, Kitchen, CulinaryChef, Accounting, AdminOffice, ExecDirector, SalesMarketing, and **MCMedTech**) still point at old-LAN IPs. **MCMedTech is stale at 192.168.2.53** even though its VLAN20 target `10.0.20.74` is live and TCP/9100-reachable -- a safe repoint offered to Howard and held pending the GPO decision (batching it with go-live rather than one-off). All 7 VLAN20 printer targets (incl. the 3 direct-IP printers) answer TCP/9100 from CS-SERVER; gateway 10.0.20.1 pings. -- **GPO still not fleet-live.** `CSC - Point and Print (CS-SERVER)` remains pilot-scoped to DESKTOP-H6QHRR7 only; the silent-new-driver-install gap (reboot-test vs pre-stage-drivers) is still the blocker to broadening it. -- **MEMCARE-STATION rename still NOT applied.** Staged 2026-06-30 on the MemCare RECEPTIONIST-PC box (S/N MJ0KQH4R); live 2026-07-01 it still reports hostname `RECEPTIONIST-PC` -- needs the reboot. -- Both the running map `docs/printer-gpo-map.md` and the `project_cascades_vlan20_migration_routing` memory were rewritten/updated to this live state 2026-07-01. No production changes were made during the reconcile (read-only). +- **Server-share model is preferred** for domain-joined machines (`\\CS-SERVER\`). Workgroup machines get direct-IP local printer installed as SYSTEM (switch to server share on domain join). +- **Point-and-Print policy prerequisite** for standard users pulling a driver from CS-SERVER: `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers`: `RestrictDriverInstallationToAdministrators=0` + subkey `PointAndPrint` (`Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2`). Symptom without it: elevation prompt `0x800702e4` / PrintService event 513 / `0xBCB`. +- **Canon MF741CDW / MF743CDW are UFR II ONLY -- NOT PCL.** A PCL6 driver produces **Error #822**. Pull `Canon Generic Plus UFR II V250` (INF `cnlb0ma64.inf`) from a client DriverStore. +- **Static VLAN 20 printer IPs:** Front Desk Epson ET-5800 = `10.0.20.221` (`\\CS-SERVER\FrontDesk`); Life Enrichment Canon MF741CDW = `10.0.20.94` (`\\CS-SERVER\LifeEnrichment`, UFR II); Business Office Brother L8900CDW = `10.0.20.220`; Dining Room Canon MF743CDW = `10.0.20.228` (DESKTOP-MD6UQI3, direct-IP UFR II); Chef Office Brother MFC-9330CDW = `10.0.20.236` (CHEF-PC, direct-IP); MedTech Brother MFC-L8900CDW = `10.0.20.74`; MC Reception Epson ET-5800 = `10.0.20.78`. Running map: `docs/printer-gpo-map.md`. ### Synology NAS (cascadesDS) / Shared File Access -- **Device specs (confirmed live 2026-06-25 via `synology` skill):** **DS718+**, **DSM 7.2.1-69057 Update 11**, **6 GB RAM**, serial 1920PEN537202. Filesystem **ext4** (NOT Btrfs); 2x WD10EZEX 1 TB (volume1). 10 shares (homes, Public, SalesDept, Server, Management + hidden `pacs`, `Activities`, `chat`, `Sandra Fish`, `web`). 30 packages running incl. **Active Backup for Business 3.1.0**, **Synology Drive Server 3.5.0**, Chat, VPN Server, Hybrid Share. Reachable only with the Cascades site VPN up. -- **Stale Word owner (lock) files on cascadesDS shares:** Word creates a hidden `~$` owner file when a document is opened; orphaned on abrupt session end. **Fix:** delete the `~$` file(s). Confirmed 2026-06-10. -- **Accessing cascadesDS from RMM -- always use a user session, not CS-SERVER SYSTEM.** The domain-joined CS-SERVER machine account cannot authenticate to the Synology `Public` share because cascadesDS uses workgroup "CASCADES" (same short name as the AD domain), causing Kerberos auth failures. Run the command in `user_session` context of a machine where the target user is actively logged in. -- **Synology Drive sync scope (as of 2026-06-18):** The Drive Client on CS-SERVER syncs only the **Sync DSM user's My Drive** (`/volume1/homes/Sync/Drive/`) into `D:\Shares\Main` -- one-way download. The real department shared folders are **NOT** in this scope. Note: `synopkg status SynologyDrive` falsely returns "stopped" (status 263) even when active -- verify via `systemctl is-active pkgctl-SynologyDrive` and `netstat -tlnp | grep 6690`. +- **Device (confirmed live 2026-06-25):** DS718+, DSM 7.2.1-69057 Update 11, 6 GB RAM, serial 1920PEN537202. Filesystem ext4; 2x WD10EZEX 1 TB. 10 shares + hidden folders. 30 packages incl. Active Backup for Business 3.1.0, Synology Drive Server 3.5.0. +- **Synology Drive sync to CS-SERVER is ACTIVE AND WORKING** (Howard confirmed 2026-07-15). The earlier "Team Folder migration [PENDING]" notes were stale. Drive Client (v7.5.0.16085, runs as `sysadmin`) syncs shared folders to `D:\Shares\Main` on CS-SERVER. Note: `synopkg status SynologyDrive` falsely returns "stopped" (status 263) even when active -- verify via `systemctl is-active pkgctl-SynologyDrive` and `netstat -tlnp | grep 6690`. +- **Stale Word owner (lock) files on cascadesDS:** Word creates hidden `~$` files on abrupt session end. Fix: delete the `~$` file(s). (Meredith Kuhn locked doc, 2026-06-10.) +- **Accessing cascadesDS from RMM -- always use a user session, not CS-SERVER SYSTEM.** Domain-joined machine account fails Kerberos against the Synology (workgroup "CASCADES" same short name as AD domain). Run in `user_session` context of a machine where the target user is logged in. -### CS-SERVER SMB & Endpoint AV (2026-06-26) +### CS-SERVER SMB & Endpoint AV -- **The "CS-SERVER SMB error 67 outage" was a TEST-METHOD ARTIFACT, not a real outage.** RMM-dispatched SMB client commands (`net use`/`net view`/`Test-Path`/`Get-SmbConnection`, even in `user_session`) **false-negative** -- they return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for KNOWN-GOOD targets. **CS-SERVER SMB is healthy** -- `Get-SmbSession` showed 7 live SMB 3.1.1 users / 30 open files / new sessions forming. **VALIDATE SMB server-side (`Get-SmbSession`/`Get-SmbOpenFile`) or with a REAL interactive test -- never from RMM client-side results.** A drive-map `verify` failure is NOT proof of a problem (skill caveat added; errorlog `rmm/smb-testing`). -- **CS-SERVER endpoint AV was DattoAV, not GravityZone Bitdefender.** It was the Datto EDR "Endpoint Protection SDK" (Bitdefender engine + Avira "Sentry" driver -> drivers `BdSentry`/`rtp1`/`rtp2`), managed by Datto RMM (CentraStage/`CagService`) + Datto EDR Agent (`HUNTAgent`/Infocyte HUNT, tenant azcomp4587). Removing the box from the GravityZone console did nothing because GravityZone never managed it. The prior-MSP Datto stack was fully removed from CS-SERVER 2026-06-26 (services deleted, `infocyte`/`CentraStage` dirs gone, registry + kernel drivers cleared; the box was de-enrolled so removal was forced once the tamper drivers were gone). **[SUPERSEDED 2026-07-15]: the ACG-managed Datto EDR agent was subsequently REINSTALLED — CS-SERVER is protected** (agent `b41befcf-e418-4d0d-8552-bc7662364d07`, Datto EDR sensor + Datto AV, live heartbeat, defs current; verified live in the azcomp4587 console by Mike). Do not read the 6/26 removal as "server unprotected." -- **Karen Rossini share access -- RESOLVED.** `CASCADES\karen.rossini` (reset + vaulted `clients/cascades-tucson/karen-rossini.sops.yaml`, member of `SG-IT-RW`) verified able to open `\CS-SERVER\Server` shares **interactively** from another PC. Her ALDocs desktop shortcut + Quick Access pin were set on DESKTOP-LPOPV30 (`\CS-SERVER\Server\ALDocs`) via the `drive-map` skill. Note: her earlier move to CSCNet (WPA3-SAE) broke NAS-by-name resolution (unrelated side effect). +- **RMM-dispatched SMB client commands false-negative.** `net use`/`net view`/`Test-Path`/`Get-SmbConnection` in `user_session` return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for known-good targets. **CS-SERVER SMB is healthy.** Validate server-side via `Get-SmbSession`/`Get-SmbOpenFile` or an interactive test -- never from RMM client-side results. A drive-map `verify` failure is NOT proof of a problem. +- **CS-SERVER endpoint AV history (for context):** Prior-MSP installed Datto EDR "Endpoint Protection SDK" (Bitdefender engine) managed by old Datto RMM/CentraStage -- NOT GravityZone. That stack was fully removed 2026-06-26 (the "Datto removed from CS-SERVER 2026-06-26" note referred to the legacy prior-MSP stack). **ACG-managed Datto EDR (Infocyte HUNT agent `b41befcf`) was installed 2026-07-13 and is active today (verified live 2026-07-15).** The DC was unprotected between 2026-06-26 and 2026-07-13. ### Datto EDR / Bitdefender Decommission -- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack** (org `2d5ea96e`, target group `1dbd2b02`, reg key `6qw68y2rwl`). Install one-liner via `/rmm`: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`. -- **Bitdefender GravityZone BEST removal is CONSOLE-ONLY.** The GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall. Use the console "Uninstall client" task (Network -> Cascades company `66b0448e` -> machine -> Tasks). New/replacement machines: provision Datto EDR/AV only, never Bitdefender, and never carry over prior-MSP Datto RMM/CentraStage artifacts. -- **RECEPTIONIST-PC is two physical boxes sharing a hostname** (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> being renamed MEMCARE-STATION). Reconcile fleets by SERIAL, not hostname -- dedup-by-hostname masks the second box's coverage gaps. +- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack** (org `2d5ea96e`, target group `1dbd2b02`, reg key `6qw68y2rwl`). Install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`. +- **Bitdefender GravityZone BEST removal is CONSOLE-ONLY.** GravityZone Public API `createUninstallTask` is DEAD; BEST anti-tampering blocks endpoint-side uninstall. Use the console "Uninstall client" task (Network -> Cascades company `66b0448e`). New/replacement machines: provision Datto EDR/AV only, never Bitdefender, never carry over prior-MSP Datto RMM/CentraStage artifacts. +- **RECEPTIONIST-PC is two physical boxes sharing a hostname** (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> staged rename to MEMCARE-STATION, not yet applied -- needs reboot). Reconcile fleets by SERIAL, not hostname. - **BD detection script:** services `^EP(Security|Protected|Update|Redline|Integration)Service$` + uninstall-registry DisplayName ~ `Bitdefender|GravityZone` + `Test-Path 'C:\Program Files\Bitdefender'`. ### Browser / Edge -- **[BUG - FLEET] Edge 149 cannot open Office files via download-list when Downloads is a UNC-redirected folder (Chromium issue 519243472).** A regression introduced in Chromium 149 prepends `\\?\` to UNC paths without converting to the correct `\\?\UNC\` form. **Symptom:** clicking `.xlsx` or `.docx` in the Edge download panel shows "Windows cannot find '\\?\\\cs-server\...'". Text files and PDFs open fine. **Trigger:** Downloads folder redirected via GPO Folder Redirection to a UNC path. **Affected build:** Edge stable 149.0.4022.52. **Fix options (none applied as of 2026-06-08):** (1) Update Edge past the fix; (2) Interim: `--disable-features=LaunchShellExecuteViaExplorer`; (3) Zero-config: use "Show in folder" then double-click from Explorer; (4) Rollback to 148. Note: pinning to 148 forfeits security fixes; prefer option 1 or 3 for HIPAA machines. +- **[BUG - FLEET] Edge 149 cannot open Office files via download-list when Downloads is a UNC-redirected folder** (Chromium issue 519243472). Prepends `\\?\` to UNC paths without converting to `\\?\UNC\`. Affected build: Edge stable 149.0.4022.52. Fix options: (1) update Edge past the fix; (2) interim: `--disable-features=LaunchShellExecuteViaExplorer`; (3) zero-config: use "Show in folder" then double-click; (4) rollback to 148. ### Conditional Access / Caregiver Policies -- **Phased rollout -- never tenant-wide.** CA policies for caregivers now target `SG-Caregivers` (`8b8d9222-5d71-419a-936d-56d895c6c332`). The legacy "Require MFA for all users" policy stays in place. **`SG-Caregivers` is 35 members as of 2026-07-01** (was 40 on 2026-06-30; 8 offboarded, 4 new hires, roster reconciled against the client's updated list), all Business Premium licensed. -- **Enforced caregiver CA policy set (unchanged as of 2026-06-03):** - - `CSC - Block caregivers off Cascades network` (`e35614e1-e896-4a13-9407-076963af488f`) -- BLOCK if location not Cascades - - `CSC - Block caregivers on non-compliant device` (`ede985e2-ee7e-4521-88b2-34c847c3db20`) -- **DISABLED 2026-07-01** (interim: caretakers allowed on desktops + phones, on-network only, per Howard; phones-only lockdown deferred -- see `clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md`). Do not re-enable; superseded by the allow-list at final lockdown. - - `CSC - Caregiver sign-in frequency 8h` (`7d491c7a-ad90-4420-9990-40a1e676a76c`) -- **Caregiver device allow-list (2026-06-03 -- report-only):** `CSC - Caregivers: allow-listed devices only (REPORT-ONLY)` -- id `1b7fd025-1aad-47c8-9274-c32c3e0b163c`; state `enabledForReportingButNotEnforced`. Device filter (mode `exclude`): `(device.displayName -startsWith "CSC-") -or (device.extensionAttribute1 -eq "CSCCaregiverDevice")`. Includes: NURSESTATION-PC (deviceId `d3bf931f`), Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, LAPTOP-8P7HDSEI, ASSISTNURSE-PC (needs re-join + re-tag after Win11 reinstall). -- **GDAP exclusion:** CA policy 3 must exclude "Service provider users" (GDAP foreign principals) + `SG-External-Signin-Allowed` + `SG-Break-Glass`, otherwise ACG partner admins lose access at CA cutover. -- **[FIXED 2026-07-01]** `Require MFA for all users` policy (`7e87a1c7...`) now excludes BOTH `SG-Caregivers-Pilot` and the live `SG-Caregivers` (`8b8d9222`); break-glass excludeUsers preserved. Caretakers get no MFA prompt -- protected by on-network block + 8h sign-in frequency instead. Remove the stale pilot-group exclude at pilot cleanup. -- **[ROOT CAUSE 2026-07-01] `pilot.test` login success masked two separate blockers for real caretakers.** `pilot.test` sits in `SG-Caregivers-DeviceTest`/`SG-Caregivers-Test`, which are excluded from the compliance-block policy and targeted by the allow-list -- so it never hit either problem. Live `SG-Caregivers` members hit BOTH: the MFA-exclude gap above, and the compliance-block treating every device as noncompliant (no phone or Windows device is Intune-managed). A pilot passing on a device-test group does not prove the production group will pass the same CA gauntlet -- verify against the live group's actual excludes/targets before declaring go-live, found via a full CA policy JSON pull. -- **Interim caretaker CA posture (2026-07-01, Howard, supersedes the 2026-06-24 hold):** desktops AND phones allowed, on-network only. `CSC - Block caregivers on non-compliant device` (`ede985e2`) is DISABLED and superseded -- do not re-enable it. Phones-only lockdown is deferred to end of rollout; tracking list `clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md`. -- **Pilot cleanup required when done:** Delete `pilot.test@cascadestucson.com`, clean up `howard.enos@cascadestucson.com`, remove `SG-Caregivers-Pilot` from CA policy targets and delete the group. - -### EXO / Message Trace - -- **Get-MessageTrace is deprecated.** Use `Get-MessageTraceV2` instead. V2 has a 10-day max window -- loop 9 consecutive windows to cover 90 days. -- **EXO access token auth:** When `Connect-ExchangeOnline -Credential` fails and the app cert is not in the Windows cert store, use client_credentials flow to get an EXO-scoped token and pass it via `-AccessToken`. +- **Phased rollout -- never tenant-wide.** CA policies for caregivers target `SG-Caregivers` (`8b8d9222-5d71-419a-936d-56d895c6c332`). **`SG-Caregivers` is 35 members as of 2026-07-01** (after 8 offboarded, 4 new hires, roster reconciled). +- **Enforced caregiver CA policy set:** + - `CSC - Block caregivers off Cascades network` (`e35614e1`) -- BLOCK if location not Cascades + - `CSC - Block caregivers on non-compliant device` (`ede985e2`) -- **DISABLED 2026-07-01**. Do not re-enable; superseded by the allow-list at final lockdown. + - `CSC - Caregiver sign-in frequency 8h` (`7d491c7a`) +- **Caregiver device allow-list (report-only):** `1b7fd025`; state `enabledForReportingButNotEnforced`. Device filter (mode `exclude`): `(device.displayName -startsWith "CSC-") -or (device.extensionAttribute1 -eq "CSCCaregiverDevice")`. Includes: NURSESTATION-PC (deviceId `d3bf931f`), Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, LAPTOP-8P7HDSEI, ASSISTNURSE-PC (needs re-join + re-tag after Win11 reinstall). +- **GDAP exclusion:** CA blocking policies must exclude "Service provider users" (GDAP foreign principals) + `SG-External-Signin-Allowed` + `SG-Break-Glass`. +- **[ROOT CAUSE 2026-07-01] `pilot.test` login success masked two separate blockers.** `pilot.test` is in `SG-Caregivers-DeviceTest` / `SG-Caregivers-Test` -- excluded from the compliance-block and targeted by the allow-list. Live `SG-Caregivers` members hit BOTH problems. A pilot passing on a device-test group does NOT prove the production group will pass the same CA gauntlet. +- **Interim caretaker CA posture (2026-07-01):** desktops AND phones allowed, on-network only. Phones-only lockdown deferred to end of rollout. ### Wireless / UniFi RF -- **[APPLIED 2026-06-19 -- validated] Production RF optimization applied + kept:** - - **2.4 power -> MEDIUM on 47 radios** (42 over-thinned-`low` floors 1-4 + 5 MemCare `auto`/full radios 505/517/608/615/622). The 24 thinned-disabled radios stayed disabled; 5 mesh-auto APs untouched. Non-regressive. Per-AP targeting required -- `apply-radio power --zone` re-enables disabled radios (confirmed gotcha). - - **5 GHz -> clean DFS 40 MHz channels** on 72 non-mesh APs (channels 52/60/100/108/116/124/132/140), 0 co-channel, mesh excluded. **Result: 5 GHz retry roughly HALVED -- 8.7 -> 3.8 avg, median 8.2 -> 2.1.** Validated; all 72 APs holding DFS, 0 radar vacates. Voice nudged back to 5 GHz (kick-sta). - - **CSCNet BSS-transition (802.11v) ON.** 6 GHz BLOCKED (WPA3 mandate on WPA2/PPSK SSID -- deferred to Howard). - - **[KEY DATA -- DFS decision reversed] Full channel survey (74/74 APs) proved DFS channels here are 4-5x cleaner (2-3% busy) than non-DFS (ch149=12%, ch157=28%, ch44=22% -- the property's worst channels).** Consumer/neighbor gear avoids DFS; choosing channels from measured scan (not a non-DFS policy) delivered the win. **Always: scan -> `survey-report.py` -> `channel-plan --channels` -> apply -> validate.** Do NOT use UniFi auto-channel; do NOT apply a non-DFS-only policy without checking the survey data for this site. -- **Fleet (full audit 2026-06-16):** 77 U7-Pro APs, **12 switches**, ~587 wireless clients. Controller: UOS at 172.16.3.29, HTTPS 11443; site short name `va6iba3v`. No UniFi gateway (pfSense is the gateway). -- **Primary pain band is 2.4 GHz.** Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor BSSID density (ch6 ~33k BSSIDs, ch1 ~19k, ch11 ~17k). 27 of the 40 worst clients stuck on 2.4 GHz, mostly IoT/legacy hardware. Experience splits by band: 5/6 GHz clients are fine; clients that land or stick on 2.4 GHz suffer. -- **6 GHz is nearly unused -- root cause: CSCNet not broadcasting 6 GHz** (`wlan_bands=[2g,5g]`, found 2026-06-18). 75 radios active but only ~1 client because the band is dark at the SSID level. Largest untapped, clean, non-DFS capacity. Enabling requires WPA3+PMF conversion on the 427-client SSID -- Howard's supervised decision. -- **Poly phone drops (2026-06-17) -- CLOSED.** Root cause = intentional pfSense reboot on 2026-06-16 22:38:12 MST (one fleet-wide event; 28/30 phones each dropped once). Only a gateway-level event explains all-floors-at-once. -- **DHCP is healthy.** pfSense dhcpd.log: 1241 ACK / 1 NAK / 0 no-free-leases. Per-room /28 HIPAA segmentation is intentional; do NOT flatten. `sta_dhcp_failures` metric is client/WiFi-side, not pfSense-side. -- **Switch audit (2026-06-16):** ~25 ports linked at 100 Mbps but gig-capable (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches; investigate after WiFi Phase A). Offline switches (Switch 4th Floor #2, USW Pro Max 16) are **offline by design -- not an issue** (Howard 2026-07-15); Switch 2nd Floor #2 reset+re-adopted 2026-06-17. Port p38 (1st Floor USW) 4.0% tx-drop rate. -- **Mesh topology:** 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108. These must NEVER be disabled or powered down via zone command -- coverage-thin auto-excludes them. -- **AP-hang recovery:** use `device-control.sh cascades poe-cycle "" --apply`. Do NOT use `force-provision` -- it took AP 445 offline during the Floor-4 pilot. -- **Tooling (`unifi-wifi` skill -- feature-complete as of 2026-06-19):** - - Collectors: `audit-site.sh`, `live-stats.sh`, `model-rank.sh`, `radio-usage.sh`, `coverage-thin.sh`, `neighbor-collect.sh`, `survey-collect.sh`, `dfs-check.sh`, `switch-audit.sh`, `gw-audit.sh`, `monitor-run.sh`, `sites.sh`. - - **`survey-report.py` (NEW 2026-06-19) -- the channel-decision driver:** rolls `survey-collect` JSON into the fleet per-channel/per-band-group measured busy% table + cleanest/dirtiest ranking + suggested clean 40 MHz palette. Run it BEFORE any channel change; it's what makes the DFS-vs-non-DFS call from facts. Previously `survey-collect`'s report AND `channel-plan`'s palette had a non-DFS bias baked in -- both fixed 2026-06-19. - - Apply (gated + rollback): `apply-radio.sh`, `apply-wlan.sh`, `client-control.sh`, `device-control.sh`, **`channel-plan.sh` (DATA-DRIVEN: `--channels ` or `--dfs ok|avoid|only`)**. - - pfSense: `pfsense-ssh.sh` (audit/dhcp/run -- SSH backend, no RESTAPI package needed; **blocked over VPN -- onsite only**). -- **Creds (vault refs only):** `infrastructure/uos-server-ssh-key` (SSH/Mongo), `infrastructure/uos-server-network-api-rw` (RW API), `clients/cascades-tucson/unifi-ap-ssh` (per-AP SSH, needs site VPN), `clients/cascades-tucson/pfsense-firewall` (pfSense admin for pfsense-ssh.sh). +- **[APPLIED 2026-06-19 -- validated] Production RF optimization:** + - 2.4 GHz power -> MEDIUM on 47 radios; 24 thinned-disabled radios stayed disabled. + - 5 GHz -> clean DFS 40 MHz channels on 72 non-mesh APs; retry HALVED (8.7->3.8 avg, median 8.2->2.1); 0 radar events. + - CSCNet BSS-transition (802.11v) ON. +- **Primary pain band is 2.4 GHz.** Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor BSSID density (ch6 ~33k BSSIDs). IoT/legacy clients stuck on 2.4. +- **6 GHz nearly unused** -- CSCNet not broadcasting 6 GHz (`wlan_bands=[2g,5g]`). 75 radios active but only ~1 client. Enabling requires WPA3+PMF conversion on the 427-client SSID -- Howard's supervised decision. +- **DFS channels here are 4-5x cleaner than non-DFS** (survey-proven; ch149=12%, ch157=28% vs DFS 2-3% busy). Always: scan -> `survey-report.py` -> `channel-plan --channels` -> apply -> validate. Do NOT use UniFi auto-channel or a non-DFS-only policy without measuring. +- **Offline switches (Switch 4th Floor #2, USW Pro Max 16) are offline BY DESIGN -- not an issue** (Howard confirmed 2026-07-15). Do not flag or investigate. +- **AP-hang recovery:** `device-control.sh cascades poe-cycle "" --apply`. Do NOT use `force-provision` (took AP 445 offline during the Floor-4 pilot). +- **Tooling (`unifi-wifi` skill):** `audit-site.sh`, `live-stats.sh`, `survey-report.py` (the channel-decision driver), `channel-plan.sh` (data-driven: `--channels ` or `--dfs ok|avoid|only`), `apply-radio.sh`, `apply-wlan.sh`, `dfs-check.sh`, `switch-audit.sh`, `device-control.sh`, `pfsense-ssh.sh` (onsite only -- blocked over VPN). ### VoIP / Network Device Migration -- **Re-VLANing a wired switch port requires a link bounce to force re-DHCP.** Changing the native VLAN on a UniFi switch port does not reset the NIC link; the device holds its old DHCP lease. Fix: bounce the port (PoE power-cycle for PoE devices; disable/enable via controller API for non-PoE). A UniFi client block/unblock is a MAC-address filter only -- it does NOT bounce the link. Controller API port-bounce requires the `X-CSRF-Token` from the login response header (`x-updated-csrf-token`). -- **Externally-powered devices (AudioCodes desk phones) need a PHYSICAL power-cycle, not a controller bounce.** The 8 AudioCodes sit on USW-16-PoE ports 1-8 but run on **external power bricks (PoE OFF on those ports)** -- so a UniFi PoE power-cycle AND a controller port disable/enable are both no-ops. They held their old main-LAN DHCP leases until Howard physically powered each off/on (2026-06-18) -> VOICE leases `.224-.231`. -- **UniFi controller PUT 403 / CSRF:** rapid controller writes can 403 -- read the CSRF token from the `x-updated-csrf-token` response header (TOKEN-cookie JWT as fallback). -- **API scratch files must be written OUTSIDE the repo.** Controller-scratch written CWD-relative got swept into commits. Use `mktemp -d` outside the repo; `.gitignore` patterns (`.fleet*`, `.ap[0-9]*`, `.vq[0-9]*`, `.q[0-9]*`) added as a backstop. -- **Verify VLAN membership via the client `vlan` field, not the controller's displayed IP.** IP field caches/lags (Kitchen server phone showed stale 192.168.1.126 while actually on vlan:30). -- **Build UNC from `[char]92` in RMM PowerShell payloads.** Literal `\\` collapses to a single `\` through jq/agent, mangling the path. Recurs across printer + share dispatch. +- **Re-VLANing a wired switch port requires a link bounce to force re-DHCP.** Changing native VLAN does not reset the NIC link. Bounce via PoE power-cycle (PoE devices) or disable/enable via controller API (non-PoE). A UniFi block/unblock is a MAC filter only -- does NOT bounce the link. +- **Externally-powered devices (AudioCodes desk phones) need a PHYSICAL power-cycle.** 8 AudioCodes are on USW-16-PoE ports 1-8 with external power bricks (PoE OFF on those ports) -- controller PoE-cycle and port disable/enable are both no-ops. +- **UniFi controller PUT 403 / CSRF:** rapid writes can 403 -- read CSRF token from `x-updated-csrf-token` response header. +- **Verify VLAN membership via the client `vlan` field, not the controller's displayed IP.** IP field caches/lags. +- **Build UNC from `[char]92` in RMM PowerShell payloads.** Literal `\\` collapses to `\` through jq/agent. -### Voice QoS (VLAN 30) -- design (2026-06-18, NOT yet built) +### Voice QoS (VLAN 30) -- design, NOT yet built -Full design: `docs/network/phase1-voice-qos-design.md`. Status DESIGN -- nothing applied. - -- **The VLAN move's QoS payoff: all voice is one subnet `10.0.30.0/24`,** so QoS matches all voice by **source subnet** -- no per-PBX SIP/RTP port guessing. Phones confirmed marking **DSCP EF (46)**. -- **QoS is INSURANCE, not the everyday fix.** Measured WAN1 fiber upload ~522 Mbps vs ~98 Mbps peak usage -> WAN is not the day-to-day constraint. QoS earns its place for (1) **WAN2 (coax) failover** and (2) rare WAN1 saturation. The everyday dropped-calls cause is **RF** (band selection). -- **Layered design:** **L1 pfSense HFSC shaper** on BOTH WANs -- 3 queues `qVoice` (prio 7, realtime ~30%, source `10.0.30.0/24` via floating out rule), `qACK` (~10%), `qDefault` (~60%). **L2 UniFi WMM** maps DSCP EF -> WiFi Voice AC. **L3 UniFi switch QoS.** Blocker for L1 sizing: WAN2 coax upload number. -- **Build path:** pfSense GUI -> Traffic Shaper -> Wizard "Multiple Lan/Wan". Howard drives. Rollback = disable/remove the shaper (zero residual; reverts to FIFO). +Design: `docs/network/phase1-voice-qos-design.md`. pfSense HFSC shaper on BOTH WANs -- 3 queues `qVoice` (prio 7, realtime ~30%, src `10.0.30.0/24`), `qACK` (~10%), `qDefault` (~60%). UniFi WMM maps DSCP EF -> WiFi Voice AC. Blocker for sizing: WAN2 coax upload number. QoS is insurance (WAN2 failover + rare WAN1 saturation); everyday dropped-calls cause is RF (band selection). ### pfSense Operations -- **pfSense 25.07 logs are PLAIN TEXT, not binary clog.** Read with `tail`/`grep` directly. Using `clog` returns empty output and will cause false conclusions. -- **[2026-06-30] LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN.** The rule's Gateway = WAN_Group (dual-WAN), so CS-SERVER -> VLAN 20 (and any LAN -> internal-VLAN) traffic gets shoved out a WAN and fails -- NOT a firewall block. Fix: a **top LAN pass rule, Gateway = default**, scoped to the source (e.g. src CS-SERVER `192.168.2.248`, dst `10.0.20.0/24`) so residents/guests on other ingress interfaces don't match. Do it in the GUI (SSH/22 is blocked from the OpenVPN subnet). -- **pfSense OpenVPN `--inactive` idle timeout:** ~300s; disconnects idle clients after ~5 min of no tunnel data. Keepalive pings do NOT reset it. Fix: raise/disable `--inactive` on the server profile. Proposed 2026-06-18; not applied. -- **pfSense SSH/22 is blocked from the OpenVPN subnet** (GUI 443 open). The unifi-wifi `pfsense-ssh.sh` skill silently returns empty over VPN (sends ssh stderr to /dev/null) -- use the GUI remotely, or SSH from onsite. -- **pfSense dirty-boot / duplicate dhcpd:** After an unclean pfSense shutdown, dhcpd may start twice. Fix: `killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php`; verify one instance: `pgrep -f "dhcpd -user" | wc -l` == 1. Note: `pfSsh.php` is slow (~20-40s); use timeout 60s+. -- **Post-outage device stragglers:** Devices that booted during a DHCP-down window cache a disconnected state and do not retry once the network recovers. Realistic plan: reactive power-cycle as reports come in. Cox modem must be rebooted after a pfSense configuration restore. +- **pfSense 25.07 logs are PLAIN TEXT.** Read with `tail`/`grep`. `clog` returns empty output. +- **LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN** (Gateway=WAN_Group). Fix: top LAN pass rule, Gateway=default, scoped source. Do it in the GUI (SSH/22 blocked from OpenVPN subnet). +- **pfSense OpenVPN `--inactive` idle timeout:** ~300s; disconnects idle clients after ~5 min. Keepalive pings do NOT reset it. Fix proposed 2026-06-18; not applied. +- **pfSense dirty-boot / duplicate dhcpd:** After unclean shutdown, dhcpd may start twice. Fix: `killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php`; verify one instance: `pgrep -f "dhcpd -user" | wc -l` == 1. -### Known Issues / Pending Hygiene (as of 2026-07-01) +### Known Issues / Pending Hygiene -- **[FIXED 2026-07-01] Stale exclude-group on MFA-all-users policy.** The `Require multifactor authentication for all users` policy (`7e87a1c7...`) excluded only `SG-Caregivers-Pilot` (`0674f0bc...`); PATCHed to also exclude the live `SG-Caregivers` (`8b8d9222...`). The stale pilot-group exclude was left in place -- remove it at pilot cleanup. -- **[PENDING] Zeke Huerta MFA (Authenticator) registration.** Moved off `SG-Caregivers` to front desk 2026-07-01; now under the tenant-wide MFA policy with no registered method. -- **[DESIGN] ALIS-native 2FA is not a perimeter control.** Force all ALIS logins through Entra SSO (SSO-only, credential fallback disabled); disable ALIS-native 2FA per-user then globally. -- **[INFO] Android enrollment token expiry (2027-05-08) does NOT unenroll devices.** Renewal needed only before enrolling new devices after that date. -- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** Investigate after WiFi optimization is stable. -- **[INFO] Offline switches are BY DESIGN -- not an issue** (Howard, 2026-07-15). Switch 4th Floor #2 + USW Pro Max 16 are intentionally offline; Switch 2nd Floor #2 was reset+re-adopted 2026-06-17. Do not flag or investigate. +- **[URGENT -- 2026-07-16 PM] Juan Andrade offboarding.** Disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`. +- **[PENDING] Zeke Huerta MFA (Authenticator) registration.** No registered method since front-desk move. +- **[PENDING] Break-glass accounts** (`breakglass1-csc@`, `breakglass2-csc@`) not yet created. Required before final CA allow-list flip. +- **[PENDING] Object-access audit logging on file server** (SS164.312(b) gap). No forensic trail on D:\Homes / PHI shares. +- **[PENDING] BAA inventory incomplete.** Several potential business associates unaccounted for. +- **[PENDING] Stale `SG-Caregivers-Pilot` exclude-group on `Require MFA for all users` policy.** Remove at pilot cleanup. +- **[PENDING] ALIS-native 2FA disable.** Force all ALIS logins through Entra SSO; disable per-user then globally. +- **[PENDING] Microsoft case for `INTUNE_A PendingInput`** -- does NOT block caregiver access (hybrid+GPO path replaces Intune dependency). +- **[PENDING] Named Location tightening.** Non-caregiver devices on the building network can currently pass the location check. - **[SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1).** Encrypted go-forward but credential must be rotated. -- **[FLEET] Endpoint security migration substantially complete (2026-06-30; CS-SERVER covered 2026-07-13).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~35 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER cleaned of legacy Datto 6/26 and **re-enrolled in Datto EDR 2026-07-13 (HUNTAgent=Running, cmd `0a60cac7`)** -- the DC had been unprotected in between. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop. +- **[SECURITY -- OPEN] Tenant Admin SP holds standing PAA role.** See Access section. Pending Mike's decision. +- **[PENDING] MEMCARE-STATION rename not applied.** Staged 2026-06-30 on MemCare RECEPTIONIST-PC box (S/N MJ0KQH4R); still reports as `RECEPTIONIST-PC` -- needs reboot. +- **[PENDING] pfSense OpenVPN `--inactive` timeout fix** and **Netgate AutoConfigBackup** enable. +- **[PENDING] DESKTOP-TRCIEJA GravityZone BD uninstall** (console-only). Box slated for hardware replacement. +- **[PENDING] 6 GHz on CSCNet** -- WPA3 conversion required; Howard's supervised decision. +- **[PENDING] Bistro phone replacement** -- Bistro has no phone (Kitchen server phone pulled 2026-06-19; Bistro phone relocated to Kitchen). +- **[PENDING] MemCare min-RSSI (floors 5/6)** -- deferred until Howard adds new APs to floors 5/6. +- **[PENDING] WAN2 (coax) upload measurement** -- needed to size pfSense HFSC voice QoS. +- **[PENDING] Audit retention infra** (LAW 90d + Storage 6yr) approved 2026-04-29, not yet built. +- **[PENDING] M365 relicensing** -- ~30 office staff on suspended Business Standard; right-size onto supported licenses (~$375-575/mo net-new depending on mix). +- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** 34 active 100Mb ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240). Investigate after WiFi optimization stable. ### Security Incidents (historical) -- **Megan Hiatt (2026-04-16):** Active credential-stuffing -- 126 failed sign-ins, bursts from Belfast GB, Hamburg DE. Password reset and SMTP AUTH disable were action items. Mailbox was clean (not breached). **Re-verify the April remediation held** (flagged again during Tamra offboarding 2026-06-30). -- **John Trozzi (2026-04-16, 2026-04-20):** Investigated twice -- both times NO BREACH. First: credential stuffing flag (clean). Second: inbound phishing email (clean). +- **Megan Hiatt (2026-04-16):** Active credential-stuffing -- 126 failed sign-ins, bursts from Belfast GB, Hamburg DE. Password reset + SMTP AUTH disable were action items. Mailbox clean. **Re-verify April remediation held** (flagged again during Tamra offboarding 2026-06-30). +- **John Trozzi (2026-04-16, 2026-04-20):** Investigated twice -- both times NO BREACH. - **Crystal Rodriguez (2026-04-19):** Phishing investigation. Report: `clients/cascades-tucson/reports/2026-04-19-crystal-rodriguez-phish-investigation.md`. -- **Canva email delivery (2026-05-20):** Alma Montt not receiving Canva invites. Resolved by adding canva.com domains to AllowedSenderDomains in EOP policies. -- **ALIS AADSTS65001 (2026-06-03):** megan.hiatt, karen.rossini, memcarereceptionist could not sign in to ALIS on non-phone devices. Root cause: missing tenant-wide admin consent on ALIS SP (`e1cae4ad`). Resolved by granting `AllPrincipals` `User.Read` via Graph API. -- **dunedolly21@gmail.com:** External guest invited 2026-04-14 by Lauren Hasselman from mobile. Status unknown -- confirm with Lauren. [unverified] - -- **Chris Knight bill.com / BOK email delivery (2026-06-04):** Root cause was SENDER-SIDE: bill.com address on SendGrid suppression list; BOK had wrong recipient email. Resolved externally by Howard. No tenant config changes needed. Ticket #32383, Resolved. +- **Canva email delivery (2026-05-20):** Resolved by adding canva.com domains to AllowedSenderDomains in EOP. +- **ALIS AADSTS65001 (2026-06-03):** Resolved by granting tenant-wide admin consent on ALIS SP (`e1cae4ad`). +- **Chris Knight bill.com / BOK email delivery (2026-06-04):** Root cause sender-side (SendGrid suppression; BOK wrong recipient email). Resolved externally. Ticket #32383. +- **dunedolly21@gmail.com:** External guest invited 2026-04-14 by Lauren Hasselman. Status unknown -- confirm with Lauren. [unverified] ### HIPAA Compliance -- **Primary objective.** Cascades stores PHI on CS-SERVER and uses ALIS for clinical records. -- **Critical open gaps:** No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled; no SMB encryption on homes share. Audit retention infra (LAW 90d + Storage 6yr) approved but not yet built. -- **Backup gap closed (2026-06-15):** Mike installed ACG cloud backup (MSP360/CloudBerry) on CS-SERVER. Verify first full completes + confirm image-based / bare-metal + system-state + retention before any drive work. -- **Restored 7 deleted mailboxes (2026-04-25)** for HIPAA SS164.316(b)(2) 7-year retention. -- **Termination policy established:** Convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold is available (Exchange Plan 2) but has been waived for the two 2026-06 offboardings (Alma, Tamra) per Howard's explicit no-PHI/PHI-adjacent-but-authorized calls. -- **Voice VLAN 30 (HIPAA-isolated):** All voice gear on an isolated network with internet/cloud-PBX egress only; blocked from PHI/LAN/VLAN20/mgmt. **Migration COMPLETE 2026-06-19: 37 devices on VOICE (28 Poly + 8 AudioCodes + desktop).** +- **Primary objective.** CS-SERVER and ALIS store PHI. +- **Critical open gaps:** No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled on CS-SERVER; no SMB encryption on homes share; audit retention infra approved but not built; BAA inventory incomplete; break-glass accounts not created. +- **Closed gaps:** Backup (MSP360 cloud backup 2026-06-15); MFA / CA for all users; caregiver access restricted to building network (2026-07-01); auto-lock + auto-sign-out on shared caregiver devices (GPO deployed 2026-06-05); Voice VLAN 30 isolates PHI from phone traffic (2026-06-19); HIPAA BAA covered by MCA (confirmed 2026-05-14); 7 deleted mailboxes restored 2026-04-25 for 7-year retention. +- **Termination policy established:** convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold available (Exchange Plan 2) but waived for the two 2026-06 offboardings (Alma, Tamra) per Howard's explicit no-PHI/PHI-adjacent-authorized calls. --- ## Active Work -> **Canonical remaining-work plan: `docs/REMAINING-WORK-PLAN.md`** (built 2026-06-24 from a live -> AD+RMM domain-join diff). 7 sequenced workstreams + every open ticket mapped to one. Work from it. +> **Canonical remaining-work plan: `docs/REMAINING-WORK-PLAN.md`** (built 2026-06-24; refreshed 2026-07-13/14). 7 sequenced workstreams. Work from it. -Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 managed devices.** See session logs for active project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). +*No open tickets in Syncro as of 2026-07-15. See session logs for recent work.* -- **[IN PROGRESS 2026-07-01] Caregiver phone SSO -- ALIS email-match (Howard handling), roster now 35.** Entra/identity side DONE for the current roster (`SG-Caregivers` 35 members after the 7/1 reconciliation -- 8 offboarded, 4 new hires -- Business Premium licensed, forced-change AD temp passwords vaulted `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` + `caregiver-temp-passwords-2026-07-01.sops.yaml`). Remaining: set each caregiver's ALIS staff `Email` = Entra UPN (carryover from 6/30: 23 confirmed just need Email=UPN; 5 blank-role confirm+match; 5 Med Techs revisit; 7 discharged-record reactivate-vs-recreate decisions); **new from 7/1: build ALIS staff records for Munezero, Cota, Robinson (need job roles -- Certified vs Resident Caregiver / Med Tech) and set Vallejo's ALIS Email = a.vallejo@cascadestucson.com** (she already has an ALIS record, just needed the AD account, created 7/1). Blanket-disable ALIS-native 2FA for the bucket as matched. Zeke Huerta moved to front desk 7/1 (removed from `SG-Caregivers`, needs Authenticator MFA registration, ALIS role change TBD); Kariuki ALIS dup (429856/429858) needs dedupe if she returns. Build path: `alis` skill `build-import` -> upload .xls in ALIS UI. -- **[IN PROGRESS, machines ~done / printers lagging as of 2026-07-01] VLAN 20 (CSCNET) staff + printer migration.** Live reconcile 2026-07-01: **22 machines online on VLAN 20**, only CS-SERVER (by design) + ~6 stragglers left on the old LAN. Printer shares only **4/15** repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); MCMedTech still stale at 192.168.2.53 though its target 10.0.20.74 is live+reachable (safe repoint held pending the GPO decision). pfSense CS-SERVER->VLAN20 policy-route bypass rule holding. **Next (priority order):** decide reboot-test vs pre-stage-drivers for the Point-and-Print GPO (currently pilot-scoped to DESKTOP-H6QHRR7 only) and take it fleet-wide; repoint MCMedTech + the 4 remaining stale caregiver-GPO shares (NursesPrinter, HealthServices, MCDirector, CopyRoom); repoint `CSC - Life Enrichment Printers` GPO to `\\CS-SERVER\LifeEnrichment`; reboot the MemCare RECEPTIONIST-PC box to apply the MEMCARE-STATION rename (still not applied); domain-join the workgroup boxes (DESKTOP-MD6UQI3, CHEF-PC, MEMCARE-STATION, MEMRECEPT-PC, DESKTOP-LPOPV30) then swap direct-IP printers to server shares. Map: `docs/printer-gpo-map.md`. -- **[SECURITY -- needs Global Admin] Remove the standing Privileged Authentication Administrator role from the `ComputerGuru - Tenant Admin` SP** (left over from Alma's offboarding password reset). Entra -> Roles & admins -> Privileged Authentication Administrator -> remove the SP; leave its Conditional Access Administrator role. Pending Mike's decision. See Access section. -- **[FOLLOW-UP 2026-06-30] Megan Hiatt breach re-check.** Her account carried a `CREDENTIAL_STUFFING_ACTIVE` marker in the April tenant inventory; verify the April remediation held (`/remediation-tool check megan.hiatt@`). -- **[PLANNED -- CARF accreditation] Technology and System Plan deliverable** (requested by Ashley Jensen 2026-06-24). One of the five required CARF Section-1 plans (Aging Services); must be an action document covering 8 canonical areas with per-area current tech + projected need + timeline + vendor + cost + responsible person + target/completion date, annual dated leadership sign-off. Done: gap analysis, project memory `project_cascades_carf_tech_plan`, an on-brand PDF first pass (via `impeccable`), and a pre-filled CARF intake worksheet. **Next: gather Cascades' inputs, then build the final plan branded as Cascades' (ACG as preparer); confirm the exact standard citation + review cadence.** Standing rule: all client/vendor-facing deliverables run through the `impeccable` skill before delivery. -- **[URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA).** Decision made 2026-06-18. EOL Gateway ZX6971 / i3-2120 / 8 GB / Win11-unsupported. On new machine: provision GuruRMM + Datto EDR/AV only; do NOT install Bitdefender. Do not carry over any prior-MSP Datto RMM/CentraStage artifacts. (TRCIEJA is currently BD_ACTIVE -- needs GravityZone console uninstall if kept in service before replacement.) -- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** ~35 agents enrolled (org `2d5ea96e`); **CS-SERVER EDR installed 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) closing the DC coverage gap left by the 6/26 legacy-Datto removal. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall (BD_ACTIVE); DESKTOP-F94M8UT (Alma's, powered off) queued BD-aware EDR install (cmd `a4623704`); (1) Remove Cascades from Syncro's Bitdefender deployment (GUI-only). (2) GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records (company `66b0448e`). (3) Reconcile laptop3 (EDR active, no RMM agent). (4) Confirm/remove stale EDR agents laptop1 + cascades-laptop. CS-SERVER Datto stack already fully removed 2026-06-26. -- **[URGENT] Rotate exposed Synology Cloud Signin Portal credential.** Vault commit 1fbc0e1 committed it plaintext; encrypted go-forward but exposed in git history. Also verify MDM service account + WiFi CSCNet from that commit were never plaintext. -- **[DONE 2026-06-19] Voice VLAN (VLAN 30) migration COMPLETE -- 37 devices on VOICE.** All Poly re-keyed. RF optimized (2.4 power->medium, 5 GHz clean DFS, retry halved). Billed ticket #32444 (7h prepaid). -- **[PENDING - hardware] Bistro phone replacement.** Kitchen server phone was bad (John pulled it 2026-06-19); Bistro phone relocated to Kitchen, so the **Bistro has no phone**. Set up + re-key the replacement to the voice PPSK when it arrives. -- **[WAITING ON VERTICAL - the last voice item] Set Poly handsets to 5 GHz-only.** Residual dropped-calls are a band-selection problem: phones on saturated 2.4 GHz despite strong 5 GHz signal; band-steering won't hold the Poly fleet on 5 GHz. Phone-side 5 GHz lock is the fix (or the CSC ENT device-island plan) -- request sent to Richard Turner 2026-06-19 (`docs/network/2026-06-19-vertical-5ghz-lock-request.md`), **awaiting response**. -- **[INVESTIGATE] Phone `.210`** -- on 5 GHz at -65 dBm but ~64% retry on a clean channel; anomalous. -- **[PENDING - build] Voice QoS for VLAN 30** (pfSense HFSC 3-queue on both WANs matching `10.0.30.0/24` + UniFi WMM/switch QoS). Design done, not built. Blocker for sizing: WAN2 coax upload number. -- **[PENDING - deferred] Enable 6 GHz on CSCNet.** Blocked on `Wpa3MandatoryFor6GHzBand` -- converting CSCNet from WPA2/PPSK to WPA3+PMF touches all 427 clients. Howard's supervised decision + coordinated change window. -- **[PENDING] Measure WAN2 (coax) upload** -- remote source-route test failed; get from a WAN2-routed host or the Cox bill. -- **[PENDING] Re-enable 3 AM AP auto-upgrade** (left OFF after 2026-06-19 overnight run). -- **[PENDING] Stand up recurring `dfs-check.sh` radar monitor** on the DFS channels (fold into network-logging plan). -- **[PENDING - next week] MemCare min-RSSI (floors 5/6)** -- deferred until Howard adds new APs to floors 5/6. -- **[PLANNED] Network logging / observability** -- Synology cascadesDS (DSM Log Center syslog server) as collector; pfSense + UniFi + AP syslog sources; `/stat/sta` client snapshotter. Spec: `docs/network/network-logging-plan.md`. Log Center package not yet confirmed installed. -- **[PENDING] Synology Drive Team Folder migration (department shares -> CS-SERVER).** Current Drive sync covers only the Sync-user's My Drive. Pilot on `/volume1/Server` (1.9 G) first. -- **[PENDING] Watch for post-outage device stragglers.** Fix each by power-cycle. -- **[PENDING] pfSense OpenVPN `--inactive` timeout fix.** Raise/disable the ~300s idle timeout on the Cascades OpenVPN server profile. -- **[PENDING] Enable Netgate AutoConfigBackup** on pfSense. Also verify UPS covers all core infra + PoE switches on battery-backed outlets (pfSense rectified; others not confirmed). -- **[PLANNED] KPI dashboard (Ashley Jensen):** scoped 2026-06-17; client one-pager drafted. Parked pending Ashley's day-one KPIs, data-freshness need, POS/Focus-HR specifics. Confirm ALIS analytics availability with Medtelligent. -- **[HOME->PRO upgrades]** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 2026-06-26 (2 x $99 = $198, not yet invoiced -- Syncro product 23571919). SALES4-PC upgraded by its supplier (no ACG charge). **CascadesProxess deferred to a late-night window** (Proxess access-control server, in active use for the access-control hardware install -- reboot briefly interrupts door access; verify ProxessIQ Server restarts). +- **[URGENT -- 2026-07-16 PM] Juan Andrade offboarding** -- disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`. +- **[IN PROGRESS] Caregiver phone SSO -- ALIS email-match (Howard handling), roster now 35.** Remaining: ALIS Email=UPN match for existing caregivers; build ALIS staff records for Munezero, Cota, Robinson; set Vallejo's ALIS Email=a.vallejo@; 7 discharged-record decisions; Kariuki ALIS dup (429856/429858) if she returns. +- **[IN PROGRESS, machines ~done / printers lagging] VLAN 20 (CSCNET) staff + printer migration.** 22 machines on VLAN 20; only CS-SERVER (by design) + ~6 stragglers remain. Printer shares 4/15 repointed. Next: decide reboot-test vs pre-stage-drivers for Point-and-Print GPO, take it fleet-wide; repoint MCMedTech + 4 remaining stale caregiver-GPO shares; reboot MemCare RECEPTIONIST-PC box (MEMCARE-STATION rename pending reboot); domain-join workgroup boxes. +- **[SECURITY] Break-glass accounts** (`breakglass1-csc@`, `breakglass2-csc@`) not created. Required before final CA lockdown. +- **[SECURITY] Remove standing PAA role from Tenant Admin SP.** Needs Global Admin. Pending Mike. +- **[FOLLOW-UP] Megan Hiatt breach re-check** -- `CREDENTIAL_STUFFING_ACTIVE` marker from April; verify remediation held. +- **[IN PROGRESS] CARF Technology and System Plan** -- finalized 2026-07-15 (`clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md` + .html/.pdf, 4-page branded deliverable). Howard delivering to Mike/client. Governance placeholders (*[at adoption]*) to be filled when Cascades formally adopts. +- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** 35 agents enrolled; CS-SERVER covered. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro BD deployment; GravityZone portal cleanup stale RECEPTIONIST-PC records; reconcile laptop3; confirm/remove stale EDR agents laptop1 + cascades-laptop. +- **[URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA).** EOL hardware; decision made 2026-06-18. +- **[URGENT] Rotate exposed Synology Cloud Signin Portal credential** (vault commit 1fbc0e1 plaintext exposure). +- **[PENDING] Bistro phone replacement** (no phone in Bistro since 2026-06-19 Kitchen relocation). +- **[PLANNED -- 60-90 days] Repurpose Synology NAS as onsite backup for CS-SERVER** (per tech plan; online off-site backup continues). +- **[PLANNED] CSC ENT device-island consolidation** (Poly voice + Helpany sensors -> 5 GHz-only WPA2 PPSK; enables later CSCNet WPA3/WiFi7/6 GHz). Design: `docs/network/csc-ent-device-island-plan.md`. +- **[PLANNED -- hardware] CS-SERVER SSD upgrade** (2x enterprise SATA SSD already purchased; scheduled window with confirmed backup). +- **[PLANNED] Voice QoS for VLAN 30** -- design done, not built. Blocker: WAN2 coax upload. +- **[PLANNED] Network logging / observability** -- Synology as syslog collector, pfSense + UniFi + AP sources. Spec: `docs/network/network-logging-plan.md`. +- **[PLANNED] KPI dashboard (Ashley Jensen)** -- parked pending Ashley's day-one KPIs. +- **[PENDING] Home->Pro upgrade: CascadesProxess** -- deferred to a late-night window (access-control appliance, active use). 2 x $99 (NurseAssist + DESKTOP-MD6UQI3) not yet invoiced -- Syncro product 23571919. +- **[PENDING] Enable 6 GHz on CSCNet** -- WPA3 conversion, Howard's decision. +- **[PENDING] Enable Netgate AutoConfigBackup** on pfSense. +- **[PENDING] pfSense OpenVPN `--inactive` timeout fix.** +- **[PENDING] ALIS app session timeout** lower from 20 to 15 min (Howard, ALIS admin). +- **[PENDING] File server audit logging** (SS164.312(b) gap -- no NTFS/object-access audit trail on D:\Homes). **Device-readiness for domain migration (2026-06-24 audit + 6/26 upgrades):** -- **READY to join** (Pro/Enterprise, internal): DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC (Bruce), LAPTOP-E0STJJE8; after a reboot: ASSISTMAN-PC (Meredith), ANN-PC, Laptop2; CHEF-PC after #32254. NurseAssist + DESKTOP-MD6UQI3 now Pro (6/26). -- **BLOCKED -- Windows Home (until Pro):** LAPTOP-8P7HDSEI, MDIRECTOR-PC (Shelby), MEMREct-PC. CascadesProxess deferred (appliance, late-night). -- **OneDrive KFM ON** (unlink before folder-redirect): LAPTOP-8P7HDSEI, NurseAssist. -- **LAPTOP-DRQ5L558** is off the Cascades LAN -- get on-site before join. -- **Decision 2026-06-24 [SUPERSEDED 2026-07-01]:** the "caregivers stay TEST-scoped until all devices domain-ready" hold was replaced by the interim CA posture (desktops + phones, on-network only -- see Conditional Access section). The device allow-list (`1b7fd025`) remains TEST-scoped **and report-only**; final lockdown = scope to `SG-Caregivers` + set to enforced. - -**Migration phase status (as of 2026-06-30):** - -| Machine / User | Status | -|---|---| -| Sharon Edwards (DESKTOP-DLTAGOI) | Domain-joined, folder redirect working via registry workaround. LifeEnrichment printer (UFR II) mapped 6/30. | -| Ashley Jensen (DESKTOP-U2DHAP0) | Domain-joined, folder redirect manually fixed | -| Crystal Rodriguez (CRYSTAL-PC) | Domain-joined, folder redirect confirmed working 2026-05-21 | -| RECEPTIONIST-PC (frontdesk box, MJ0KQHNP) | Domain-joined 2026-05-22; FrontDesk printer (.221) mapped 6/30 | -| RECEPTIONIST-PC (MemCare box, MJ0KQH4R) | **Rename to MEMCARE-STATION STAGED 6/30** (applies next reboot); MedTech printer (.74) set up | -| NURSESTATION-PC | Domain-joined, folder redirect complete | -| Lauren Hasselman | Domain-joined, folder redirect complete 2026-05-23 | -| Megan Hiatt (Marketing) | COMPLETE 2026-05-27 | -| DESKTOP-KQSL232 (Lois Lane -- old box) | Decommissioned (removed from EDR straggler list 6/26) | -| HEALTH-SERVICES (Lois Lane) | Domain-joined (confirmed 2026-06-24) | -| CHEF-PC (JD Martin), MDIRECTOR-PC, MEMREct-PC, LAPTOP-8P7HDSEI | Workgroup / Home-blocked -- direct-IP printers now; domain-join + GPO migration pending | -| NurseAssist, DESKTOP-MD6UQI3 (Dining/Alyssa) | **Upgraded to Pro 6/26**; DESKTOP-MD6UQI3 got direct-IP Dining printer (.228). Domain-join pending. | -| SALES4-PC (Tamra -- OFFBOARDED) | User offboarded 6/30; machine upgraded to Pro by supplier | -| ASSISTMAN-PC (Meredith), ANN-PC, DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC (Bruce) | Pro/Enterprise + internal -- **READY to join** | -| DESKTOP-TRCIEJA (Lupe Sanchez) | **EOL hardware -- replace instead of migrate.** BD_ACTIVE (needs console uninstall if kept). | - -**Blocking issues / pending:** -- M365 relicensing: remaining suspended Business Standard users -> Business Premium (O365 Standard SKU SUSPENDED) -- Break-glass accounts: not created (confirmed 2026-05-27); YubiKey arrival unconfirmed -- Audit retention infra: approved 2026-04-29, not yet built -- Entra Connect: OU=Administrative not yet in sync scope; UPN suffix updates for that OU pending -- NURSESTATION-PC: reboot required to activate `CSC - Caregiver Device Lockdown` GPO (deployed 2026-06-05) -- Caregiver device allow-list: ASSISTNURSE-PC needs re-join + re-tag after Win11 reinstall; LAPTOP-8P7HDSEI Win11 upgrade + join/tag pending; then cutover -- ALIS office/privileged standardization: move office/managers/nurses to ALIS SSO-only; disable ALIS-native 2FA per-user then globally -- Fix stale `SG-Caregivers-Pilot` exclude-group on `Require MFA for all users` policy -- ALIS app session timeout: lower from 20 to 15 min (Howard, ALIS admin) -- PENDING -- **[CORRECTED 2026-06-24] CS-SERVER RAID is HEALTHY (live OMSA), not degraded.** No emergency drive swap. Planned reliability upgrade: replace the 2 consumer 320 GB drives with the 2x enterprise SSD already purchased, on a scheduled window. **[WARN] PSU redundancy lost.** Service Tag 9MQFTK1. -- **[INFO] CS-SERVER cloud backup (MSP360/CloudBerry):** verified running 2026-06-24. Still confirm image-based/bare-metal/system-state + retention. +- **READY to join:** DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC, LAPTOP-E0STJJE8; after reboot: ASSISTMAN-PC, ANN-PC, Laptop2; NurseAssist + DESKTOP-MD6UQI3 now Pro (6/26). +- **BLOCKED -- Windows Home:** LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMREct-PC. CascadesProxess deferred. +- **EOL/replace:** DESKTOP-TRCIEJA (Lupe Sanchez), ASSISTMAN-PC (Meredith), MDIRECTOR-PC (Shelby), MEMRECEPT-PC (MC front desk), CHEF-PC (Culinary) + spare deploy. Per CARF tech plan. --- @@ -688,65 +552,48 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man | 2026-03-31 | Cascades onboarded to remediation tool. Tenant ID documented. 50 users, Secure Score 34%. | | 2026-04-13 | Major onsite: 13 stale AD accounts deleted, OU structure cleaned, UPNs migrated to cascadestucson.com, Homes share created, Folder Redirection GPO deployed (registry workaround), first domain joins. | | 2026-04-14 | Sandra Fish global admin revoked. ALIS SSO confirmed. Business Premium proposal created. | -| 2026-04-16 | Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish. /remediation-tool skill built. | +| 2026-04-16 | Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish. | | 2026-04-17 | Howard onsite: folder redirect Sharon Edwards diagnosis. John Trozzi WiFi (TP-Link + UniFi roaming instability). | | 2026-04-25 | Entra Connect installed on CS-SERVER (staging mode). 7 deleted mailboxes restored for HIPAA. Dual-WAN discovered. | | 2026-04-28-29 | CA policy reconciliation. Audit retention architecture (ACG-billed, LAW 90d + Storage 6yr). Break-glass design (2 accounts, YubiKeys). Caregiver pilot scope corrected (phased only). | | 2026-04-30 | CA rollout (Report-only mode): 3 caregiver policies created. SDM bootstrap. | | 2026-05-01 | Howard billed 33.5 hrs against prepaid block on Entra project ticket #32214 ($0 invoice). | | 2026-05-07-08 | SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault. | -| 2026-05-14-16 | Caregiver AD accounts created. Entra Connect exited staging -- actively syncing. Wireless diagnostic (read-only via cloud API; 2.4 GHz saturation hypothesis identified). | -| 2026-05-18 | Billing review. 39.5 hrs remaining before session. 7 hrs billed separately. | +| 2026-05-14-16 | Caregiver AD accounts created. Entra Connect exited staging -- actively syncing. Wireless diagnostic (2.4 GHz saturation hypothesis identified). | +| 2026-05-18 | Billing review. 7 hrs billed separately. | | 2026-05-20 | Canva email delivery resolved (canva.com domains added to EOP). | | 2026-05-21 | Crystal Rodriguez folder redirect confirmed working. | | 2026-05-22 | Ashley Jensen domain-joined. RECEPTIONIST-PC domain-joined. GPO ILT fixes. cascadesDS auth failure diagnosed (workgroup collision) and deferred. | -| 2026-05-23 | Lauren Hasselman folder redirect complete. Megan Hiatt (Marketing) confirmed in AD, domain join pending. | -| 2026-05-26 | Access control vendor meeting onsite (ticket #32324). 0.5h Howard + 0.5h Mike billed. Block at 28.0h. | -| 2026-06-03 | ALIS AADSTS65001 diagnosed and resolved: granted tenant-wide admin consent on ALIS SP `e1cae4ad`. Caregiver device allow-list CA policy created in report-only (`1b7fd025`). | -| 2026-06-04 | Three same-day tickets: #32381 Tamra scanner (0.5h onsite), #32382 Megan file access (1.5h onsite), #32383 Chris Knight bill.com/BOK email delivery (1.5h remote). Root cause sender-side. | -| 2026-06-05 | NURSESTATION-PC localadmin login-screen issue resolved. Caregiver test rig built. Hybrid Entra Join + GPOs deployed: `CSC - Caregiver Workstation` validated; `CSC - Caregiver Device Lockdown` deployed to `OU=Caregiver Devices`. Ticket #32303 billed 7.0h, invoice #67782 ($0.00 prepaid). | -| 2026-06-08 | **Chris Knight workstation setup (onsite).** DESKTOP-N5G1ROO domain-joined + GuruRMM-enrolled. **MAJOR: root-caused native Folder Redirection failure** -- FR GPO targets were in misnamed `fdeploy1.ini`; fixed by writing correct `fdeploy.ini` + version bump. **ASSISTNURSE-PC reinstalled (Win10->Win11).** Edge UNC download bug diagnosed (no fix applied). | -| 2026-06-09 | **Accounting scan-to-folder built.** `D:\Shares\Accounting` on CS-SERVER; shared as `\\CS-SERVER\AcctDept`; `svc-scan` service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured (NTLMv2, confirmed). Persistent drive maps set. | -| 2026-06-10 | **Meredith Kuhn locked Word doc -- stale owner files on cascadesDS.** Five orphaned `~$` files deleted via RMM. Ticket #32403, 0.5h remote, block 56.75->56.25. | -| 2026-06-12 | **Created shared mailboxes grievances@ + Surveys@ and delegated to Meredith & Ashley.** All 8 permission grants verified. Ticket #32417, 0.5h remote, block 56.25->55.75. | -| 2026-06-15 | **Wireless RF full audit -- controller access gained.** Mike vaulted SSH key + RW admin + AP SSH. Live audit confirmed 77 U7-Pro APs, ~574->587 clients, 2.4 GHz saturation as primary pain band. | -| 2026-06-15 | **CS-SERVER slowness root-caused to (then) degraded RAID-1; cloud backup started; pfSense OpenVPN password reset.** MSP360/CloudBerry cloud backup installed on CS-SERVER (closes HIPAA backup gap). | -| 2026-06-16 | **Voice VLAN plan for Vertical phones (PLANNED).** Designed VLAN 30 VOICE; cutover runbook written. Floor-4 2.4 GHz power-down pilot applied. `dfs-check.sh` confirmed ZERO real radar events fleet-wide. `unifi-wifi` skill feature-complete. | -| 2026-06-16 | **pfSense confirmed as pfSense Plus 25.07-RELEASE; health verified; Howard-Home LAN renumbered** (removed collision with Cascades). `pfsense-ssh.sh` built. | -| 2026-06-17 | **Voice VLAN 30 built + verified; Vertical desktop + initial Poly phones migrated.** pfSense igc1.30 interface + isolation rules built. | -| 2026-06-17 | **Power outage -- full site down + recovery.** pfSense on UPS surge-only side -> unclean shutdown -> duplicate dhcpd + 2nd-floor switch one-way L2. Recovered; pfSense moved to battery, config vaulted. Pre-existing plaintext Synology signin credential found (vault commit 1fbc0e1). | -| 2026-06-17 | **KPI dashboard scoping (advisory).** 9 reporting systems catalogued. Recommended Phase 1 (exports->SharePoint->Power BI Pro). Parked. | -| 2026-06-18 | **Voice VLAN 30 cutover (8 AudioCodes added; 22 Poly done).** AudioCodes required physical power-cycle. Per-phone diagnosis: dropped-calls are RF (band selection). 6 GHz root-caused dark. Optimization master plan built. | -| 2026-06-18 | **DESKTOP-TRCIEJA (Lupe Sanchez) perf diagnosed; replace decision.** EOL hardware + dual real-time AV. | -| 2026-06-18 | **Synology Drive sync architecture diagnosed.** Sync-user My Drive only; real shared folders NOT mirrored. Team Folder plan produced. | -| 2026-06-18 | **Power outage follow-ups: OpenVPN flapping root-caused (--inactive timeout); kitchen printer straggler resolved.** | -| 2026-06-19 | **PRODUCTION RF OPTIMIZATION APPLIED (2 AM window) -- 5 GHz retry HALVED.** 2.4 power -> MEDIUM on 47 radios. CSCNet BSS-transition ON. Full channel survey (74/74 APs) proved DFS 4-5x cleaner than non-DFS; data-driven clean-DFS plan applied to 72 non-mesh APs (retry 8.7->3.8 avg, 0 co-channel, 0 radar). `survey-report.py` added. | -| 2026-06-19 | **Voice VLAN migration COMPLETE (29/29 Poly) + band-selection diagnosis + Vertical 5 GHz handoff.** Howard re-keyed all remaining Poly handsets. 5 GHz-only lock request sent to Richard Turner (Vertical) = last voice item. Kitchen server phone bad (pulled); Bistro relocated to Kitchen; Bistro now has no phone. Billed ticket #32444 (7h), block 55.75->48.75. | -| 2026-06-23 | **Planned power outage (05:30-09:00 MST) -- clean shutdown executed + verified.** All three core devices self-shut-down on local schedules (independent of tunnel), UPS carried them through. Verified clean at 05:31. Pre-flight confirmed cloud backup SUCCESS + iDRAC/Synology auto-restart backstops. Runbook logged. | -| 2026-06-24 | **Syncro ticket review + #32193 Executive share + device-readiness audit + consolidated plan.** Built restricted share `\\cs-server\Executive` (billed 0.5h). Live AD+RMM domain-join diff; 5 on Windows Home blocked. Built `docs/REMAINING-WORK-PLAN.md` (7 workstreams). Caregivers stay TEST-scoped. | -| 2026-06-24 | **CS-SERVER RAID live-verified -- the "degraded/failing" flag was STALE; mirror is healthy.** Live Dell OMSA showed both virtual disks Ok, all 5 disks Online/green; the 6/15 degraded self-recovered. 1:0:4 = GLOBAL HOT SPARE. PSU redundancy lost surfaced. No drive pulled; the 2x SSD become a *planned* upgrade. Service Tag 9MQFTK1. | -| 2026-06-24 | **CARF Technology and System Plan deliverable started (Ashley Jensen).** First-pass technology-plan packet mapped to the 8 CARF areas; conformance gap analysis + on-brand PDF (via `impeccable`) + pre-filled intake worksheet. Standing rule: outbound deliverables run through `impeccable`. | -| 2026-06-24 | **CSC ENT device-island consolidation plan (voice + Helpany).** Repurpose CSC ENT as a permanent 5 GHz-only WPA2 PPSK island carrying Poly voice (-> VLAN 30) + Helpany radar sensors (-> new VLAN 40); both vendors transition remotely. Unblocks later CSCNet WPA3/6 GHz move. | -| 2026-06-25 | **Alma Montt OFFBOARDED (terminated; MC Life Enrichment; no PHI/ALIS).** M365: sessions revoked, sign-in blocked, password vaulted, mailbox -> SharedMailbox (Shelby FullAccess+AutoMap), SPB seat freed, hidden from GAL, groups removed. On-prem AD: disabled, moved to `OU=Excluded-From-Sync`. No litigation hold. Left tenant-security item: Tenant Admin SP holds standing PAA (Graph blocked teardown) -- needs GA removal. | -| 2026-06-25 | **Endpoint security migration: Datto EDR/AV rollout + Bitdefender decommission begins.** Reconciled 33 GuruRMM devices vs 27 Datto EDR agents; found 8 gaps. Deployed EDR to 6 online clean machines (27->33). Discovered RECEPTIONIST-PC is two physical boxes sharing a hostname (serials MJ0KQH4R, MJ0KQHNP); only one had EDR -- installed on the second (33->34). Removed Bitdefender BEST 8.26.6.644 from both RECEPTIONIST boxes via GravityZone console (API uninstall dead). Cleaned 6 orphaned BD folders. Queued EDR/BD-checks on offline machines; watcher `bfm81iqdz` left polling. | -| 2026-06-26 | **CS-SERVER: full Datto stack removal + SMB "outage" debunked.** The endpoint AV was DattoAV (Datto EDR "Endpoint Protection SDK", Bitdefender engine + Avira Sentry), managed by Datto RMM (CentraStage) + Datto EDR Agent (HUNTAgent/Infocyte, tenant azcomp4587) -- NOT GravityZone (so the console removal did nothing). Removed ALL Datto software. **The long "SMB error 67" investigation was a TEST-METHOD ARTIFACT** -- RMM-dispatched SMB client cmds false-negative even for good targets; CS-SERVER SMB is healthy (`Get-SmbSession` = 7 users / 30 open files). Karen Rossini share access verified interactively; ALDocs shortcut set. Built the `drive-map` skill. | -| 2026-06-26 | **EDR/Bitdefender straggler 9am pass.** BD-checked reconnected machines: DESKTOP-MD6UQI3, Laptop4, SALES4-PC clean; **DESKTOP-TRCIEJA = BD_ACTIVE** (needs GravityZone console uninstall). NurseAssist queued EDR install confirmed (agent `23c3c36e`). DESKTOP-F94M8UT (Alma's, powered off) EDR install queued; DESKTOP-KQSL232 (Lois's old box) decommissioned/removed from list. | -| 2026-06-26 | **Windows Home->Pro upgrades continued.** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (changepk edition flip as SYSTEM -> 2-min user reboot warning -> slmgr MAK/ato). Both VOLUME_MAK Licensed. Confirmed NurseAssist is a distinct machine from Assistnurse-pc. SALES4-PC done by supplier. CascadesProxess deferred to a late-night window (access-control appliance in active use). 2 x $99 to bill. | -| 2026-06-29 | **ALIS caregiver phone-only + caretaker-only crosscheck.** Cross-checked the staff CSV against the live ALIS roster (107 Hired, communityId 622): phone-only caregivers = NONE (only the 3 Transportation drivers are phone-only, and they don't need ALIS); 30 caretaker-only; 2 caregivers carry extra roles (Feller, Nyanzunda); 3 "Care" entries are directors/nurses; **7 caregiver-list people exist in ALIS only as Discharged records** (decide reactivate-vs-recreate). | -| 2026-06-30 | **Caregiver phone SSO -- license + group + temp-password onboarding.** Completed the Entra/identity side for all 40 frontline caregivers: added the 2 missing to `SG-Caregivers` (now 40), assigned Business Premium (Howard bought 11 more seats -> SPB 34->45 enabled), and set unique forced-change AD temp passwords (vaulted `caregiver-temp-passwords-2026-06-30.sops.yaml`, delivered via Discord DM). `SG-Caregivers` corrected to frontline caregivers ONLY (excl. Feller/Nyanzunda). Remaining gate: ALIS Email=UPN match (Howard) + create ALIS records for 7 + AD accounts for 3 ALIS-only caregivers. | -| 2026-06-30 | **Tamra Matthews OFFBOARDED (Move-In Coordinator; left June 2026).** Cloud-only M365 object: sessions revoked, sign-in blocked, password vaulted, mailbox -> SharedMailbox (Crystal/Megan/Meredith/Ashley FullAccess+AutoMap), O365 Standard seat freed, hidden from GAL, 3 groups stripped. On-prem AD disabled + moved to `OU=Excluded-From-Sync`. No litigation hold despite PHI-adjacent role (Howard authorized). AutoMapping rollback on rapid grants root-caused (spaced one-at-a-time fix). Follow-up: Megan Hiatt breach re-check. | -| 2026-06-30 | **VLAN 20 (CSCNET) printer migration.** Migrated Front Desk Epson ET-5800 (.221) + Life Enrichment Canon MF741 (.94) onto VLAN 20 server shares, then dining/chef/medtech/MC-reception. Root-caused a hard blocker: CS-SERVER couldn't reach VLAN 20 printers because the LAN "allow LAN to any" rule policy-routed internal traffic out the WAN (WAN_Group gateway) -- fixed with a top LAN pass rule (gw=default, src CS-SERVER). Established the Point-and-Print policy fix for standard-user driver installs and the Canon UFR-II-only driver requirement (PCL6 -> Error #822). Staged RECEPTIONIST-PC (MemCare box) rename to MEMCARE-STATION. GPO planning doc `docs/printer-gpo-map.md` created. | -| 2026-07-01 | **VLAN 20 migration live-reconciled -- much further along than docs showed.** Full GuruRMM fleet pull found **22 machines already on VLAN 20** (only CS-SERVER by design + ~6 stragglers remain on the old LAN), but printer shares lag at **4/15** repointed (MCMedTech still stale 192.168.2.53 despite its live target 10.0.20.74). Rewrote `docs/printer-gpo-map.md` to the live state and updated the `project_cascades_vlan20_migration_routing` memory. No production changes made (read-only reconcile); MCMedTech repoint offered and held pending Howard's GPO go-live decision. Also fixed Howard-Home Tailscale (`UnattendedMode=always`) after it dropped RMM/coord reachability. | -| 2026-07-01 | **Caretaker roster update + caregiver phone-login CA cutover.** Reconciled the client's updated caretaker list 1:1 against live AD: disabled 8 (7 leavers + the Lassey duplicate, client confirmed Tele Sepopo Lassey Assiakoley = Celia Lassey) with SG-removal + license reclaim, created 4 new hires (Vallejo, Munezero, Cota, Robinson) with temp passwords vaulted, removed Zeke Huerta from `SG-Caregivers` (front desk, OU move deferred -- Entra Connect sync scope is OU=Caregivers/Groups/Caregiver Devices only), and reaffirmed Nyanzunda stays out (frontline-only rule). `SG-Caregivers` now 35; SPB 45 enabled / 41 consumed. Verified phone/desktop login end-to-end and found + fixed two CA blockers `pilot.test` had masked: the known MFA-exclude bug (added live `SG-Caregivers` to the exclude, fixing the wiki-tracked bug) and the compliance-block policy (`ede985e2`) blocking every device as Intune-noncompliant -- disabled, superseded by the allow-list at final lockdown. Interim posture (Howard's go, overrides the 6/24 hold): caretakers on desktops + phones, on-network only; phones-only lockdown deferred to end of rollout with a tracking list (`docs/cloud/caretaker-phones-only-list.md`). | -| 2026-07-02 | **Caregiver phone login: forced-change gotcha resolved + `PSO-Caregivers` created.** Caregiver temp passwords are used on shared phones that cannot run the "must change password at next logon" flow, so any password expiry re-breaks phone login for the whole cohort. Created a Fine-Grained Password Policy `PSO-Caregivers` on CS-SERVER (never-expire) to stop the 42-day domain `MaxPasswordAge` from re-expiring them (~2026-08-13). Roster cleanup pass alongside. Undo: `Remove-ADFineGrainedPasswordPolicy PSO-Caregivers` (it is `ProtectedFromAccidentalDeletion`). | -| 2026-07-02 | **Shelby Trozzi "Company Web Docs" share + mapped drive.** Made `D:\Shares\Public\Company Web Docs` on CS-SERVER an SMB share gated at the share ACL (Shelby = Change, Admins = Full; NTFS left inherited), so the `Public` NTFS tree stayed untouched. Shelby had never logged into her domain account (`logonCount = 0`) and had no vaulted password; confirmed her OU is outside Entra Connect sync scope, so an on-prem reset was safe -- reset, set never-expires, vaulted. RMM could not push the drive map (`user_session` double-hop -> SMB error 67); worked around with `cmdkey` + a persistent `HKCU:\Network\W` map that mounts at next logon, then mapped it interactively to confirm. | -| 2026-07-09 | **Charity Menle caregiver rename (rename, never re-create).** Resolved that Charity Sika (CSV) and Bariffa Sika (ALIS 309045) are the same person, since legally renamed to Charity Menle; renamed the AD/Entra account to match rather than creating a new object. Established the procedure: `Set-ADUser` for Surname/DisplayName/UPN/EmailAddress, `Rename-ADObject` for the CN, `Set-ADUser -SamAccountName`, then a delta `Start-ADSyncSyncCycle`. Entra export is async -- poll before concluding the sync failed. | -| 2026-07-09 | **Chris Knight granted access to the accounting mailbox.** Added FullAccess (AutoMapping) + SendAs on the `accounting@cascadestucson.com` SharedMailbox via EXO REST `InvokeCommand` (`exchange-op` tier), matching the existing Lauren/Ashley/Zachary delegate tier. Two harness defects surfaced: `consent-audit.sh` graded the tenant RED "app NOT consented" when the real fault was a local vault-path lookup (the tenant was fully consented -- a false negative that points at emailing the client a needless consent link), and a post-write `Get-RecipientPermission` omitted the new SendAs trustee due to EXO replication lag. Both logged to `errorlog.md`. | -| 2026-07-13 | **Datto EDR installed on CS-SERVER (closing the DC's post-cleanup coverage gap)** -- HUNTAgent=Running, RMM cmd `0a60cac7`; the DC had been without managed endpoint protection since the 6/26 legacy-Datto removal. Full wiki+plan recheck/reconcile pass (this page + `REMAINING-WORK-PLAN.md` refreshed to live state). **Juan Andrade offboard moved to 2026-07-16 afternoon** (coord todo `80716a98` created -- none existed despite the prior note claiming one). | +| 2026-05-23 | Lauren Hasselman folder redirect complete. | +| 2026-05-26 | Access control vendor meeting onsite (ticket #32324). 0.5h Howard + 0.5h Mike billed. | +| 2026-06-03 | ALIS AADSTS65001 resolved: tenant-wide admin consent on ALIS SP. Caregiver device allow-list CA policy created (report-only, `1b7fd025`). | +| 2026-06-04 | Three same-day tickets: #32381 Tamra scanner (0.5h onsite), #32382 Megan file access (1.5h onsite), #32383 Chris Knight bill.com/BOK email delivery (1.5h remote, root cause sender-side). | +| 2026-06-05 | NURSESTATION-PC localadmin login-screen issue resolved. Hybrid Entra Join + GPOs deployed: `CSC - Caregiver Workstation` validated; `CSC - Caregiver Device Lockdown` deployed to `OU=Caregiver Devices`. Ticket #32303, 7.0h. | +| 2026-06-08 | Chris Knight workstation setup (onsite). DESKTOP-N5G1ROO domain-joined + GuruRMM-enrolled. Root-caused native Folder Redirection failure -- fdeploy1.ini misnamed; fixed with correct fdeploy.ini + version bump. ASSISTNURSE-PC reinstalled (Win10->Win11). Edge UNC download bug diagnosed. | +| 2026-06-09 | Accounting scan-to-folder built. D:\Shares\Accounting on CS-SERVER; shared as \\CS-SERVER\AcctDept; svc-scan service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured (NTLMv2, confirmed). | +| 2026-06-10 | Meredith Kuhn locked Word doc -- stale owner files on cascadesDS. Five ~$ files deleted. Ticket #32403, 0.5h remote. | +| 2026-06-12 | Created shared mailboxes grievances@ + Surveys@ and delegated to Meredith + Ashley. All 8 permission grants verified. Ticket #32417, 0.5h remote. | +| 2026-06-15 | Wireless RF full audit -- controller access gained. 77 U7-Pro APs, ~574->587 clients, 2.4 GHz saturation confirmed as primary pain. CS-SERVER backup started (MSP360/CloudBerry). pfSense OpenVPN password reset. | +| 2026-06-16 | Voice VLAN plan for Vertical phones designed. Floor-4 2.4 GHz power-down pilot applied. dfs-check.sh confirmed ZERO real radar events fleet-wide. unifi-wifi skill feature-complete. pfSense confirmed pfSense Plus 25.07-RELEASE. | +| 2026-06-17 | Voice VLAN 30 built + verified; Vertical desktop + initial Poly phones migrated. Power outage -- full site down + recovery (pfSense on UPS surge-only side -> unclean shutdown -> duplicate dhcpd + 2nd-floor switch one-way L2; recovered; pfSense moved to battery). Plaintext Synology signin credential found (vault commit 1fbc0e1). KPI dashboard scoping (advisory, parked). | +| 2026-06-18 | Voice VLAN 30 cutover (8 AudioCodes added; 22 Poly done). AudioCodes required physical power-cycle. Per-phone diagnosis: dropped-calls are RF (band selection), not VLAN. 6 GHz root-caused dark. Optimization master plan built. DESKTOP-TRCIEJA (Lupe Sanchez) perf diagnosed; replace decision. Synology Drive sync architecture diagnosed. | +| 2026-06-19 | PRODUCTION RF OPTIMIZATION APPLIED (2 AM window): 2.4 GHz power -> MEDIUM on 47 radios; clean DFS 40 MHz plan applied to 72 non-mesh APs; 5 GHz retry HALVED. Voice VLAN migration COMPLETE (29/29 Poly re-keyed). Kitchen server phone bad (pulled); Bistro phone relocated. Billed ticket #32444, 7h. | +| 2026-06-23 | Planned power outage (05:30-09:00 MST) -- clean shutdown executed. All three core devices self-shut-down on local schedules. Verified clean at 05:31. | +| 2026-06-24 | CS-SERVER RAID live-verified healthy (live OMSA; the earlier "degraded" flag was stale; 6/15 self-recovered; 1:0:4 = GLOBAL HOT SPARE). PSU redundancy lost noted. Executive share built (\\cs-server\Executive, billed 0.5h). Live AD+RMM domain-join diff; built docs/REMAINING-WORK-PLAN.md (7 workstreams). CARF Technology and System Plan deliverable started (Ashley Jensen). CSC ENT device-island consolidation plan (voice + Helpany). | +| 2026-06-25 | Alma Montt OFFBOARDED (terminated; MC Life Enrichment; no PHI/ALIS). Endpoint security migration begins: Datto EDR/AV rollout + Bitdefender decommission started; RECEPTIONIST-PC identified as two physical boxes. | +| 2026-06-26 | CS-SERVER: full legacy Datto stack removal + SMB "outage" debunked (was a test-method artifact -- RMM-dispatched SMB cmds false-negative). EDR/Bitdefender straggler 9am pass. Windows Home->Pro upgrades: NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (2 x $99, to invoice). | +| 2026-06-29 | ALIS caregiver phone-only + caretaker-only crosscheck: phone-only caregivers = NONE (only 3 Transportation drivers are phone-only, no ALIS needed). 7 caregiver-list people exist in ALIS only as Discharged records. | +| 2026-06-30 | Caregiver phone SSO -- license + group + temp-password onboarding complete for 40 frontline caregivers (Business Premium assigned; vaulted temp passwords; `SG-Caregivers` corrected to frontline-only). Tamra Matthews OFFBOARDED (Move-In Coordinator). VLAN 20 printer migration (FrontDesk, LifeEnrichment, others); policy-routing root cause found + fixed in pfSense. MEMCARE-STATION rename staged. | +| 2026-07-01 | VLAN 20 migration live-reconciled -- 22 machines on VLAN 20, printer shares 4/15. Caretaker roster update: 8 accounts disabled + license reclaimed, 4 new hires created (Vallejo, Munezero, Cota, Robinson), Zeke Huerta moved to front desk (OU move deferred). SG-Caregivers now 35. CA phone/desktop login verified end-to-end; two CA blockers fixed (pilot.test had masked both). Interim caretaker CA posture (desktops + phones, on-network only) -- Howard's go, overrides 6/24 hold. | +| 2026-07-02 | Caregiver phone login: forced-change gotcha resolved (cleared `ChangePasswordAtLogon` for all 35 SG-Caregivers -- had failed as err=50126). PSO-Caregivers (never-expire FGPP) created on CS-SERVER. Shelby Trozzi "Company Web Docs" share built; domain account password vaulted. | +| 2026-07-09 | Charity Menle caregiver rename (AD rename procedure established, never re-create). Chris Knight granted FullAccess+SendAs on accounting@ SharedMailbox. Android enrollment token replaced (Replace, not Revoke -- stale token root-caused). Intune: 14 phones powered off (noncompliant status not a fault); storage fields confirmed not collected for COSU devices. | +| 2026-07-13 | Datto EDR installed on CS-SERVER (closing DC coverage gap since 2026-06-26 legacy-Datto removal). HUNTAgent=Running, RMM cmd 0a60cac7. Wiki + REMAINING-WORK-PLAN.md refreshed. Juan Andrade offboard moved to 2026-07-16 afternoon; coord todo 80716a98 created. | +| 2026-07-14 | Wiki + remaining-work-plan reviewed end-to-end (recovered session). HIPAA gaps identified: Juan Andrade access overdue, no break-glass accounts, Named Location too loose, no object-access audit logging, BAA inventory incomplete. | +| 2026-07-15 | CARF Technology and System Plan finalized (4-page branded PDF, Done/To-do per area, 8 CARF areas + supplementary). Live verification sweep confirmed: EDR/AV active on all 35 agents incl. CS-SERVER; M365 SPB 45/41/4; DMARC/DKIM/SPF live; VLAN 30 voice 37 clients; MSP360 file backup success today. jodi.ramstack DECOMMISSIONED (disabled, sessions revoked, Business Standard license removed; no mailbox existed). Synology shared-folder syncs to CS-SERVER confirmed working (stale wiki notes corrected). Mike (GURU-5070) verified EDR and M365 licensing live; sent correction to Howard via coord. | --- ## Backlinks - [[projects/gururmm]] -- RECEPTIONIST-PC + CS-SERVER enrolled (site CascadesTucson); fleet EDR/BD + Home->Pro + printer work driven via GuruRMM -- [[wiki/systems/uos-server]] -- shared UOS controller hosts the Cascades UniFi site (site_id `685f39068e65331c46ef6dd2`); SSH/Mongo access via `infrastructure/uos-server-ssh-key` +- [[wiki/systems/uos-server]] -- UniFi controller hosts Cascades site va6iba3v diff --git a/wiki/index.md b/wiki/index.md index 71c641f2..46fd8bbf 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -19,7 +19,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks. | Article | Summary | Last Compiled | |---|---|---| -| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **37.5 hrs remaining** (live 2026-07-10); senior living; active domain migration + HIPAA caregiver-lockdown project (GPOs deployed; Entra Hybrid Join + CA allow-list + ALIS SSO model proven); single DC (CS-SERVER) on aging R610 -- RAID **live-verified HEALTHY 2026-06-24** (the 6/15 "degraded" self-recovered; both mirrors Ok, 1:0:4 = global hot spare; consumer 320GB drives + lost-PSU-redundancy are planned follow-ups, NOT an emergency); cloud backup verified running; **Planned power outage 2026-06-23** clean self-shutdown executed + verified (bring-up ~09:00, John onsite); **Voice VLAN 30 migration COMPLETE 2026-06-19** (~38 devices: 29 Poly + 8 AudioCodes + desktop; awaiting Vertical to set Poly 5GHz-only); **UniFi RF optimized 2026-06-19** (77 U7-Pro APs/~587 clients: 2.4GHz power->Medium on 47 radios + 5GHz clean-DFS 40MHz channel plan -> 5GHz retry halved; 6GHz blocked by WPA3 on PPSK SSID); Syncro 0 open tickets (live EOD 2026-06-25), device-readiness audit done (5 PCs on Win Home need Home->Pro before join); **Alma Montt offboarded 2026-06-25** (Tenant Admin SP left holding a standing PAA role -- removal pending Mike); **CARF Technology & System Plan** deliverable in progress for Ashley Jensen; **endpoint security migration started 2026-06-25** (Datto EDR/AV replacing Bitdefender; 34 agents enrolled); **CS-SERVER: all Datto software removed 2026-06-26**, and the CS-SERVER "SMB error 67" proved to be an RMM-test artifact -- server is healthy, Karen share access verified interactively; **caregiver phone login LIVE 2026-07-01: roster reconciled to 35 (8 offboarded incl. Lassey dup, 4 new hires), two CA blockers fixed (MFA-exclude bug + compliance-block disabled), interim posture = desktops+phones on-network only; ALIS Email=UPN match + 3 new-hire ALIS records pending**; **CSC ENT->VLAN 20 migration (live 2026-07-01): 22 machines on VLAN 20 (only CS-SERVER + ~6 stragglers left on old LAN); printer shares lag at 4/15 repointed; P&P GPO still pilot-scoped**; `PSO-Caregivers` never-expire FGPP created 2026-07-02 (stops the 42-day cohort re-break); Shelby "Company Web Docs" share built 2026-07-02; Chris Knight granted FullAccess+SendAs on `accounting@` 2026-07-09; remaining-work plan: docs/REMAINING-WORK-PLAN.md | 2026-07-10 | +| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **21.5 hrs remaining** (live 2026-07-15); senior living; active domain migration + HIPAA caregiver-lockdown project (GPOs deployed; Entra Hybrid Join + CA allow-list + ALIS SSO model proven); single DC (CS-SERVER) on aging R610 -- RAID **live-verified HEALTHY 2026-06-24** (the 6/15 "degraded" self-recovered; both mirrors Ok, 1:0:4 = global hot spare; consumer 320GB drives + lost-PSU-redundancy are planned follow-ups, NOT an emergency); cloud backup verified running; **Planned power outage 2026-06-23** clean self-shutdown executed + verified (bring-up ~09:00, John onsite); **Voice VLAN 30 migration COMPLETE 2026-06-19** (~38 devices: 29 Poly + 8 AudioCodes + desktop; awaiting Vertical to set Poly 5GHz-only); **UniFi RF optimized 2026-06-19** (77 U7-Pro APs/~587 clients: 2.4GHz power->Medium on 47 radios + 5GHz clean-DFS 40MHz channel plan -> 5GHz retry halved; 6GHz blocked by WPA3 on PPSK SSID); Syncro 0 open tickets (live EOD 2026-06-25), device-readiness audit done (5 PCs on Win Home need Home->Pro before join); **Alma Montt offboarded 2026-06-25** (Tenant Admin SP left holding a standing PAA role -- removal pending Mike); **CARF Technology & System Plan FINALIZED 2026-07-15** (4-page branded PDF, live-verified claims; delivered for adoption); **endpoint security migration started 2026-06-25** (Datto EDR/AV replacing Bitdefender; 34 agents enrolled); **CS-SERVER protected: ACG Datto EDR+AV reinstalled 2026-07-13, verified live 2026-07-15** (legacy prior-MSP stack removed 6/26); SMB "error 67" was an RMM-test artifact -- server healthy; **caregiver phone login LIVE 2026-07-01: roster reconciled to 35 (8 offboarded incl. Lassey dup, 4 new hires), two CA blockers fixed (MFA-exclude bug + compliance-block disabled), interim posture = desktops+phones on-network only; ALIS Email=UPN match + 3 new-hire ALIS records pending**; **CSC ENT->VLAN 20 migration (live 2026-07-01): 22 machines on VLAN 20 (only CS-SERVER + ~6 stragglers left on old LAN); printer shares lag at 4/15 repointed; P&P GPO still pilot-scoped**; `PSO-Caregivers` never-expire FGPP created 2026-07-02 (stops the 42-day cohort re-break); Shelby "Company Web Docs" share built 2026-07-02; Chris Knight granted FullAccess+SendAs on `accounting@` 2026-07-09; jodi.ramstack decommissioned 2026-07-15 (no mailbox remained); Synology->CS-SERVER share sync confirmed working; remaining-work plan: docs/REMAINING-WORK-PLAN.md | 2026-07-15 | | [Dataforth Corporation](clients/dataforth.md) | Prepaid block ~$2,099/mo, **24.75 hrs remaining** (live 2026-07-14, 4 open tickets); signal-conditioning manufacturer; DOS test stations (NWTOC v5.1 deployed fleet-wide 2026-07-05); MYDATA TPSys SMT line controller (`myserver`, Fedora Core 3, VLAN2 — root recovered + DR backup); **2026-07-14: PBX SIP DNAT durable fix (native UniFi Port Forwarding rule, #32553) + Sage printing fix (stale RDP sessions on SAGE-SQL, #32552; Sage `guru` credential vaulted at `clients/dataforth/sage`)**; Sage Pro 200 ERP runs on SAGE-SQL RDS only (Easy Print redirection — native drivers not installed, watch item); 2025 ransomware recovery + incomplete file restore; 2026-03 phishing + MFA; test-datasheet pipeline (Hoffman API + testdatadb on AD2); mail stack INKY->Mailprotector->EXO; shares-ACL project (Phase 2 strawman 2026-06-22); GuruRMM fleet ~50; Bitdefender phase-off | 2026-07-14 | | [Desert RV Center](clients/desert-rv-center.md) | Break-fix + $213.35/mo recurring; RV dealership, Huachuca City AZ; 6 managed devices; DESERTRV.local domain (LAN 10.0.0.0/24); remote users RDP into on-site VMs over **ZeroTier** ("Desert RV" net 172.29.0.0/16); **2026-07-08: restored Alicia's RDP to DRV-BECKY** (stopped ZeroTierOneService = RDP 0x204; started + auto-restart; BECKY + DESKTOP-LBO396F enrolled in GuruRMM); DRV-BECKY firewall locked to RDP-only (no silent RMM push); BECKY slowness pending; 0 open tickets | 2026-07-08 | | [Instrumental Music Center](clients/instrumental-music-center.md) | Prepaid block $175/hr; music retail/repair; AIMsi POS on IMC1\SQLEXPRESS (SQL 2019 Std, misleading name); phantom DC (ServerIMC) slow logons; **two locations split into GuruRMM Main + MOO sites 2026-07-07** (Main 14 agents / MOO 3: BigMom, GHG12G3, IMC-LUIS); full fleet enrolled; AV = Datto EDR (not Bitdefender); IMC1 SQL max-memory caps applied 2026-07-07 | 2026-07-10 |